Wang Hai a30dc6cf0d VMCI: fix NULL pointer dereference when unmapping queue pair ... I got a NULL pointer dereference report when doing fuzz test: Call Trace: qp_release_pages+0xae/0x130 qp_host_unregister_user_memory.isra.25+0x2d/0x80 vmci_qp_broker_unmap+0x191/0x320 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 vmci_host_unlocked_ioctl+0x59f/0xd50 ? do_vfs_ioctl+0x14b/0xa10 ? tomoyo_file_ioctl+0x28/0x30 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 __x64_sys_ioctl+0xea/0x120 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae When a queue pair is created by the following call, it will not register the user memory if the page_store is NULL, and the entry->state will be set to VMCIQPB_CREATED_NO_MEM. vmci_host_unlocked_ioctl vmci_host_do_alloc_queuepair vmci_qp_broker_alloc qp_broker_alloc qp_broker_create // set entry->state = VMCIQPB_CREATED_NO_MEM; When unmapping this queue pair, qp_host_unregister_user_memory() will be called to unregister the non-existent user memory, which will result in a null pointer reference. It will also change VMCIQPB_CREATED_NO_MEM to VMCIQPB_CREATED_MEM, which should not be present in this operation. Only when the qp broker has mem, it can unregister the user memory when unmapping the qp broker. Only when the qp broker has no mem, it can register the user memory when mapping the qp broker. Fixes: 06164d2b72 ("VMCI: queue pairs implementation.") Cc: stable <stable@vger.kernel.org> Reported-by: Hulk Robot <hulkci@huawei.com> Reviewed-by: Jorgen Hansen <jhansen@vmware.com> Signed-off-by: Wang Hai <wanghai38@huawei.com> Link: https://lore.kernel.org/r/20210818124845.488312-1-wanghai38@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-08-27 16:21:59 +02:00
..
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
vmci_context.c	misc: vmw_vmci: return the correct errno code	2021-06-24 15:47:13 +02:00
vmci_context.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_datagram.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_datagram.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_doorbell.c	misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct	2021-04-05 12:29:31 +02:00
vmci_doorbell.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_driver.c	vsock/vmci: make vmci_vsock_cb_host_called static	2019-11-20 12:39:29 -08:00
vmci_driver.h	vsock/vmci: register vmci_transport only when VMCI guest/host are active	2019-11-14 18:12:18 -08:00
vmci_event.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_event.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_guest.c	misc: vmw_vmci: explicitly initialize vmci_datagram payload	2021-04-05 12:29:31 +02:00
vmci_handle_array.c	VMCI: Fix integer overflow in VMCI handle arrays	2019-06-21 16:04:05 +02:00
vmci_handle_array.h	VMCI: Fix integer overflow in VMCI handle arrays	2019-06-21 16:04:05 +02:00
vmci_host.c	vmci_host: print unexpanded names of ioctl requests in debug messages	2021-03-24 08:26:31 +01:00
vmci_queue_pair.c	VMCI: fix NULL pointer dereference when unmapping queue pair	2021-08-27 16:21:59 +02:00
vmci_queue_pair.h	misc/vmw_vmci: fix typo	2021-01-26 19:18:01 +01:00
vmci_resource.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_resource.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_route.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_route.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00