From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932573AbcITIgq (ORCPT ); Tue, 20 Sep 2016 04:36:46 -0400 Received: from mx1.redhat.com ([209.132.183.28]:53212 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751594AbcITIgn (ORCPT ); Tue, 20 Sep 2016 04:36:43 -0400 Subject: Re: Virt: Kvm - Fix possible ERR_PTR() dereferencing. To: Shailendra Verma , Gleb Natapov , kvm@vger.kernel.org, Ravikant Sharma References: <1474354210-18881-1-git-send-email-shailendra.v@samsung.com> Cc: linux-kernel@vger.kernel.org, vidushi.koul@samsung.com From: Paolo Bonzini Message-ID: <6ee49836-d377-144e-3246-e4312bd0360c@redhat.com> Date: Tue, 20 Sep 2016 10:36:35 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <1474354210-18881-1-git-send-email-shailendra.v@samsung.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Tue, 20 Sep 2016 08:36:43 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 20/09/2016 08:50, Shailendra Verma wrote: > This is of course wrong to call kfree() if memdup_user() fails, > no memory was allocated and the error in the error-valued pointer > should be returned. > > Reviewed-by: Ravikant Sharma > Signed-off-by: Shailendra Verma > --- > virt/kvm/kvm_main.c | 20 ++++++-------------- > 1 file changed, 6 insertions(+), 14 deletions(-) > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 484079e..e3a0653 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -2398,10 +2398,8 @@ out_free1: > > r = -ENOMEM; > kvm_regs = memdup_user(argp, sizeof(*kvm_regs)); > - if (IS_ERR(kvm_regs)) { > - r = PTR_ERR(kvm_regs); > - goto out; > - } > + if (IS_ERR(kvm_regs)) > + return PTR_ERR(kvm_regs); This incorrectly skips the vcpu_put at the end. Paolo > r = kvm_arch_vcpu_ioctl_set_regs(vcpu, kvm_regs); > kfree(kvm_regs); > break; > @@ -2422,11 +2420,8 @@ out_free1: > } > case KVM_SET_SREGS: { > kvm_sregs = memdup_user(argp, sizeof(*kvm_sregs)); > - if (IS_ERR(kvm_sregs)) { > - r = PTR_ERR(kvm_sregs); > - kvm_sregs = NULL; > - goto out; > - } > + if (IS_ERR(kvm_sregs)) > + return PTR_ERR(kvm_sregs); > r = kvm_arch_vcpu_ioctl_set_sregs(vcpu, kvm_sregs); > break; > } > @@ -2514,11 +2509,8 @@ out_free1: > } > case KVM_SET_FPU: { > fpu = memdup_user(argp, sizeof(*fpu)); > - if (IS_ERR(fpu)) { > - r = PTR_ERR(fpu); > - fpu = NULL; > - goto out; > - } > + if (IS_ERR(fpu)) > + return PTR_ERR(fpu); > r = kvm_arch_vcpu_ioctl_set_fpu(vcpu, fpu); > break; > } >