Skip to content

Commit 13ade4a

Browse files
martinetdericvh
authored andcommitted
9p: virtio: fix unlikely null pointer deref in handle_rerror
handle_rerror can dereference the pages pointer, but it is not necessarily set for small payloads. In practice these should be filtered out by the size check, but might as well double-check explicitly. This fixes the following scan-build warnings: net/9p/trans_virtio.c:401:24: warning: Dereference of null pointer [core.NullDereference] memcpy_from_page(to, *pages++, offs, n); ^~~~~~~~ net/9p/trans_virtio.c:406:23: warning: Dereference of null pointer (loaded from variable 'pages') [core.NullDereference] memcpy_from_page(to, *pages, offs, size); ^~~~~~ Reviewed-by: Simon Horman <[email protected]> Signed-off-by: Dominique Martinet <[email protected]> Signed-off-by: Eric Van Hensbergen <[email protected]>
1 parent eee4a11 commit 13ade4a

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

net/9p/trans_virtio.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -384,7 +384,7 @@ static void handle_rerror(struct p9_req_t *req, int in_hdr_len,
384384
void *to = req->rc.sdata + in_hdr_len;
385385

386386
// Fits entirely into the static data? Nothing to do.
387-
if (req->rc.size < in_hdr_len)
387+
if (req->rc.size < in_hdr_len || !pages)
388388
return;
389389

390390
// Really long error message? Tough, truncate the reply. Might get

0 commit comments

Comments
 (0)