[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 02/12] vfio/migration: Fix NULL pointer dereference bug
From: |
Alex Williamson |
Subject: |
[PULL 02/12] vfio/migration: Fix NULL pointer dereference bug |
Date: |
Thu, 16 Feb 2023 16:02:00 -0700 |
User-agent: |
StGit/1.5.dev2+g9ce680a52bd9 |
From: Avihai Horon <avihaih@nvidia.com>
As part of its error flow, vfio_vmstate_change() accesses
MigrationState->to_dst_file without any checks. This can cause a NULL
pointer dereference if the error flow is taken and
MigrationState->to_dst_file is not set.
For example, this can happen if VM is started or stopped not during
migration and vfio_vmstate_change() error flow is taken, as
MigrationState->to_dst_file is not set at that time.
Fix it by checking that MigrationState->to_dst_file is set before using
it.
Fixes: 02a7e71b1e5b ("vfio: Add VM state change handler to know state of VM")
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Link: 20230216143630.25610-3-avihaih@nvidia.com">https://lore.kernel.org/r/20230216143630.25610-3-avihaih@nvidia.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
---
hw/vfio/migration.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 83d2d44080a6..65f3f3bef795 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -741,7 +741,9 @@ static void vfio_vmstate_change(void *opaque, bool running,
RunState state)
*/
error_report("%s: Failed to set device state 0x%x", vbasedev->name,
(migration->device_state & mask) | value);
- qemu_file_set_error(migrate_get_current()->to_dst_file, ret);
+ if (migrate_get_current()->to_dst_file) {
+ qemu_file_set_error(migrate_get_current()->to_dst_file, ret);
+ }
}
vbasedev->migration->vm_running = running;
trace_vfio_vmstate_change(vbasedev->name, running, RunState_str(state),
- [PULL 00/12] VFIO updates 2023-02-16, Alex Williamson, 2023/02/16
- [PULL 01/12] linux-headers: Update to v6.2-rc8, Alex Williamson, 2023/02/16
- [PULL 02/12] vfio/migration: Fix NULL pointer dereference bug,
Alex Williamson <=
- [PULL 03/12] vfio/migration: Allow migration without VFIO IOMMU dirty tracking support, Alex Williamson, 2023/02/16
- [PULL 04/12] vfio/common: Change vfio_devices_all_running_and_saving() logic to equivalent one, Alex Williamson, 2023/02/16
- [PULL 05/12] vfio/migration: Block multiple devices migration, Alex Williamson, 2023/02/16
- [PULL 06/12] vfio/migration: Move migration v1 logic to vfio_migration_init(), Alex Williamson, 2023/02/16
- [PULL 07/12] vfio/migration: Rename functions/structs related to v1 protocol, Alex Williamson, 2023/02/16
- [PULL 08/12] vfio/migration: Implement VFIO migration protocol v2, Alex Williamson, 2023/02/16
- [PULL 09/12] vfio/migration: Remove VFIO migration protocol v1, Alex Williamson, 2023/02/16
- [PULL 10/12] vfio: Alphabetize migration section of VFIO trace-events file, Alex Williamson, 2023/02/16
- [PULL 11/12] docs/devel: Align VFIO migration docs to v2 protocol, Alex Williamson, 2023/02/16
- [PULL 12/12] MAINTAINERS: Add myself as VFIO reviewer, Alex Williamson, 2023/02/16