RE: [PATCH v2] VMCI: Fix NULL pointer dereference on context ptr

[Jorgen Hansen]

> From: Arnd Bergmann [mailto:arnd@xxxxxxxx]
> Sent: Monday, March 23, 2020 10:17 AM
> On Mon, Mar 23, 2020 at 9:52 AM Greg Kroah-Hartman
> <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
> >
> > On Mon, Mar 23, 2020 at 04:22:33PM +0800, Xiyu Yang wrote:
> > > A NULL vmci_ctx object may pass to vmci_ctx_put() from its callers.
> >
> > Are you sure this can happen?
> >
> > > Add a NULL check to prevent NULL pointer dereference.
> 
> It looks like this could happen if vmci_ctx_get() returns NULL, which is
> not checked for consistently. Maybe add better error handling to the
> callers that currently don't check for that, to catch problems such as

In the cases, where the return value isn't checked, the return value of
vmci_ctx_get() won't be NULL, as the code won't be reached unless the
context ID has an associated context structure. In the example below,
the caller has obtained the context_id from an active context. That said,
it wouldn't hurt to add either checks or at least a comment as to why
the context won't be NULL in the cases, where it isn't checked today.

> 
> void vmci_ctx_rcv_notifications_release(...)
> {
>         struct vmci_ctx *context = vmci_ctx_get(context_id); /* may be NULL */
>        ...
>        context->pending_doorbell_array = db_handle_array;
>        ...
>        vmci_ctx_put(context);
> }
> 
> Checking only in vmci_ctx_put() is too late.
> 
>      Arnd

Thanks,
Jorgen