| Message ID | 20240531073636.3779559-1-oleg.sviridov@red-soft.ru |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] hw/net: prevent potential NULL dereference | expand |
On 31/5/24 09:36, Oleg Sviridov wrote: > Pointer, returned from function 'spapr_vio_find_by_reg', may be NULL and is dereferenced immediately after. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Signed-off-by: Oleg Sviridov <oleg.sviridov@red-soft.ru> > --- > v2: Debug message added > hw/net/spapr_llan.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c > index ecb30b7c76..8af33d91b6 100644 > --- a/hw/net/spapr_llan.c > +++ b/hw/net/spapr_llan.c > @@ -770,6 +770,12 @@ static target_ulong h_change_logical_lan_mac(PowerPCCPU *cpu, > SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(sdev); > int i; > > + if (!dev) { > + hcall_dprintf("H_CHANGE_LOGICAL_LAN_MAC called when " > + "no NIC is present\n"); > + return H_PARAMETER; > + } > + > for (i = 0; i < ETH_ALEN; i++) { > dev->nicconf.macaddr.a[ETH_ALEN - i - 1] = macaddr & 0xff; > macaddr >>= 8; Thanks, patch queued.
diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c index ecb30b7c76..8af33d91b6 100644 --- a/hw/net/spapr_llan.c +++ b/hw/net/spapr_llan.c @@ -770,6 +770,12 @@ static target_ulong h_change_logical_lan_mac(PowerPCCPU *cpu, SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(sdev); int i; + if (!dev) { + hcall_dprintf("H_CHANGE_LOGICAL_LAN_MAC called when " + "no NIC is present\n"); + return H_PARAMETER; + } + for (i = 0; i < ETH_ALEN; i++) { dev->nicconf.macaddr.a[ETH_ALEN - i - 1] = macaddr & 0xff; macaddr >>= 8;
Pointer, returned from function 'spapr_vio_find_by_reg', may be NULL and is dereferenced immediately after. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Oleg Sviridov <oleg.sviridov@red-soft.ru> --- v2: Debug message added hw/net/spapr_llan.c | 6 ++++++ 1 file changed, 6 insertions(+)