[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 33/53] libvhost-user: check for NULL when allocating a virtqueue e
From: |
Michael S. Tsirkin |
Subject: |
[PULL 33/53] libvhost-user: check for NULL when allocating a virtqueue element |
Date: |
Thu, 2 Mar 2023 03:26:10 -0500 |
From: Carlos López <clopez@suse.de>
Check the return value for malloc(), avoiding a NULL pointer
dereference, and propagate error in function callers.
Found with GCC 13 and -fanalyzer:
../subprojects/libvhost-user/libvhost-user.c: In function
‘virtqueue_alloc_element’:
../subprojects/libvhost-user/libvhost-user.c:2556:19: error: dereference of
possibly-NULL ‘elem’ [CWE-690] [-Werror=analyzer-possible-null-dereference]
2556 | elem->out_num = out_num;
| ~~~~~~~~~~~~~~^~~~~~~~~
‘virtqueue_alloc_element’: event 1
|
| 2554 | assert(sz >= sizeof(VuVirtqElement));
| | ^~~~~~
| | |
| | (1) following ‘true’ branch (when ‘sz > 31’)...
|
‘virtqueue_alloc_element’: events 2-4
|
| 2555 | elem = malloc(out_sg_end);
| | ^~~~ ~~~~~~~~~~~~~~~~~~
| | | |
| | | (3) this call could return NULL
| | (2) ...to here
| 2556 | elem->out_num = out_num;
| | ~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (4) ‘elem’ could be NULL: unchecked value from
(3)
|
Signed-off-by: Carlos López <clopez@suse.de>
Message-Id: <20230210112514.16858-1-clopez@suse.de>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
subprojects/libvhost-user/libvhost-user.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/subprojects/libvhost-user/libvhost-user.c
b/subprojects/libvhost-user/libvhost-user.c
index f661af7c85..0200b78e8e 100644
--- a/subprojects/libvhost-user/libvhost-user.c
+++ b/subprojects/libvhost-user/libvhost-user.c
@@ -2553,6 +2553,10 @@ virtqueue_alloc_element(size_t sz,
assert(sz >= sizeof(VuVirtqElement));
elem = malloc(out_sg_end);
+ if (!elem) {
+ DPRINT("%s: failed to malloc virtqueue element\n", __func__);
+ return NULL;
+ }
elem->out_num = out_num;
elem->in_num = in_num;
elem->in_sg = (void *)elem + in_sg_ofs;
@@ -2639,6 +2643,9 @@ vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned int
idx, size_t sz)
/* Now copy what we have collected and mapped */
elem = virtqueue_alloc_element(sz, out_num, in_num);
+ if (!elem) {
+ return NULL;
+ }
elem->index = idx;
for (i = 0; i < out_num; i++) {
elem->out_sg[i] = iov[i];
--
MST
- [PULL 25/53] pci/shpc: refactor shpc_device_plug_common(), (continued)
- [PULL 25/53] pci/shpc: refactor shpc_device_plug_common(), Michael S. Tsirkin, 2023/03/02
- [PULL 26/53] pcie: pcie_cap_slot_write_config(): use correct macro, Michael S. Tsirkin, 2023/03/02
- [PULL 29/53] pcie: pcie_cap_slot_enable_power() use correct helper, Michael S. Tsirkin, 2023/03/02
- [PULL 28/53] pcie: drop unused PCIExpressIndicator, Michael S. Tsirkin, 2023/03/02
- [PULL 31/53] pcie: set power indicator to off on reset by default, Michael S. Tsirkin, 2023/03/02
- [PULL 32/53] vhost: avoid a potential use of an uninitialized variable in vhost_svq_poll(), Michael S. Tsirkin, 2023/03/02
- [PULL 34/53] hw/pci: Trace IRQ routing on PCI topology, Michael S. Tsirkin, 2023/03/02
- [PULL 33/53] libvhost-user: check for NULL when allocating a virtqueue element,
Michael S. Tsirkin <=
- [PULL 30/53] pcie: introduce pcie_sltctl_powered_off() helper, Michael S. Tsirkin, 2023/03/02
- [PULL 35/53] chardev/char-socket: set s->listener = NULL in char_socket_finalize, Michael S. Tsirkin, 2023/03/02
- [PULL 38/53] intel-iommu: fail DEVIOTLB_UNMAP without dt mode, Michael S. Tsirkin, 2023/03/02
- [PULL 39/53] memory: introduce memory_region_unmap_iommu_notifier_range(), Michael S. Tsirkin, 2023/03/02
- [PULL 37/53] intel-iommu: fail MAP notifier without caching mode, Michael S. Tsirkin, 2023/03/02
- [PULL 42/53] MAINTAINERS: Add Fan Ni as Compute eXpress Link QEMU reviewer, Michael S. Tsirkin, 2023/03/02
- [PULL 43/53] hw/mem/cxl_type3: Improve error handling in realize(), Michael S. Tsirkin, 2023/03/02
- [PULL 48/53] hw/i386/acpi: Drop duplicate _UID entry for CXL root bridge, Michael S. Tsirkin, 2023/03/02