From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752541AbcITGue (ORCPT ); Tue, 20 Sep 2016 02:50:34 -0400 Received: from mailout1.samsung.com ([203.254.224.24]:50536 "EHLO mailout1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751453AbcITGuc (ORCPT ); Tue, 20 Sep 2016 02:50:32 -0400 X-AuditID: cbfee61b-f79466d000001e3c-4d-57e0dc31cec0 From: Shailendra Verma To: Gleb Natapov , Paolo Bonzini , kvm@vger.kernel.org, Shailendra Verma , Ravikant Sharma Cc: linux-kernel@vger.kernel.org, vidushi.koul@samsung.com Subject: Virt: Kvm - Fix possible ERR_PTR() dereferencing. Date: Tue, 20 Sep 2016 12:20:10 +0530 Message-id: <1474354210-18881-1-git-send-email-shailendra.v@samsung.com> X-Mailer: git-send-email 1.7.9.5 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrOJMWRmVeSWpSXmKPExsVy+t9jAV3DOw/CDQ43S1p8+Xmd0WLO1EKL y7vmsFns3/aP1aKpYTa7xaJvr5gt/l68xObA7rFpVSebx/t9V9k8+rasYvT4vEkugCWKyyYl NSezLLVI3y6BK2PfhA+MBa+4Ky4t/M7cwLiSs4uRk0NCwETiWtcLFghbTOLCvfVsXYxcHEIC Sxkl5t/+zAiSEBJ4zSgx9xc3iM0mYCjxuu8vE0iRiMAORoneptVg3cwCVhKT/s9mBbGFgey7 e1cC2RwcLAKqEntvSYCEeQU8JB5Nnc4EEpYQUJCYM8lmAiP3AkaGVYwSqQXJBcVJ6blGeanl esWJucWleel6yfm5mxjBwfFMegfj4V3uhxgFOBiVeHgDHt4PF2JNLCuuzD3EKMHBrCTCa3L9 QbgQb0piZVVqUX58UWlOavEhRmkOFiVx3sf/14UJCaQnlqRmp6YWpBbBZJk4OKUaGG1n8Z0u 1+m05WXLkJt31aXk8Uwvke+K/4vl95TwnPFZv0bTozxFJOmkXfEypVNP9E2MfS8oVV4pZ1MK rlM4+jD39So3t5Ml/joVP/u+cRj1LQuSDroScfXizoCAKMa9f25P4NI48fbqElb5zyvOsCxd rfJsdXekc+jJGS5bfmTsL+renv5vtRJLcUaioRZzUXEiAMQhHvYKAgAA Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is of course wrong to call kfree() if memdup_user() fails, no memory was allocated and the error in the error-valued pointer should be returned. Reviewed-by: Ravikant Sharma Signed-off-by: Shailendra Verma --- virt/kvm/kvm_main.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 484079e..e3a0653 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -2398,10 +2398,8 @@ out_free1: r = -ENOMEM; kvm_regs = memdup_user(argp, sizeof(*kvm_regs)); - if (IS_ERR(kvm_regs)) { - r = PTR_ERR(kvm_regs); - goto out; - } + if (IS_ERR(kvm_regs)) + return PTR_ERR(kvm_regs); r = kvm_arch_vcpu_ioctl_set_regs(vcpu, kvm_regs); kfree(kvm_regs); break; @@ -2422,11 +2420,8 @@ out_free1: } case KVM_SET_SREGS: { kvm_sregs = memdup_user(argp, sizeof(*kvm_sregs)); - if (IS_ERR(kvm_sregs)) { - r = PTR_ERR(kvm_sregs); - kvm_sregs = NULL; - goto out; - } + if (IS_ERR(kvm_sregs)) + return PTR_ERR(kvm_sregs); r = kvm_arch_vcpu_ioctl_set_sregs(vcpu, kvm_sregs); break; } @@ -2514,11 +2509,8 @@ out_free1: } case KVM_SET_FPU: { fpu = memdup_user(argp, sizeof(*fpu)); - if (IS_ERR(fpu)) { - r = PTR_ERR(fpu); - fpu = NULL; - goto out; - } + if (IS_ERR(fpu)) + return PTR_ERR(fpu); r = kvm_arch_vcpu_ioctl_set_fpu(vcpu, fpu); break; } -- 1.9.1