[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v2 2/2] memory: fix possible NULL pointer derefe
From: |
Philippe Mathieu-Daudé |
Subject: |
Re: [Qemu-devel] [PATCH v2 2/2] memory: fix possible NULL pointer dereference |
Date: |
Wed, 11 Jul 2018 10:47:18 -0300 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.0 |
Hi Dima,
On 07/11/2018 05:34 AM, Dima Stepanov wrote:
> Gentle ping. CCing Paolo Bonzini.
>
> Regards, Dima.
>
> On Tue, Jun 19, 2018 at 05:12:16PM +0300, Dima Stepanov wrote:
>> Ping.
>>
>> Regards, Dima.
>>
>> On Wed, Jun 13, 2018 at 11:19:55AM +0300, Dima Stepanov wrote:
>>> In the memory_region_do_invalidate_mmio_ptr() routine the section
>>> variable is intialized by the memory_region_find() call. The section.mr
>>> field can be set to NULL.
>>>
>>> Add the check for NULL before trying to drop a section.
>>>
>>> Signed-off-by: Dima Stepanov <address@hidden>
>>> ---
>>> memory.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/memory.c b/memory.c
>>> index 3212acc..bb45248 100644
>>> --- a/memory.c
>>> +++ b/memory.c
>>> @@ -2712,7 +2712,7 @@ static void
>>> memory_region_do_invalidate_mmio_ptr(CPUState *cpu,
>>> /* Reset dirty so this doesn't happen later. */
>>> cpu_physical_memory_test_and_clear_dirty(offset, size, 1);
>>>
>>> - if (section.mr != mr) {
>>> + if (section.mr && (section.mr != mr)) {
section.mr can't be NULL here.
You can give the static analyzer a hint using "assert(section.mr);"
>>> /* memory_region_find add a ref on section.mr */
>>> memory_region_unref(section.mr);
>>> if (MMIO_INTERFACE(section.mr->owner)) {
>>> --
>>> 2.7.4
>>>
Regards,
Phil.
signature.asc
Description: OpenPGP digital signature