blob: a02b005c419cb81ba7e25a3471776cd23a08ce02 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
id = 2311
title = "Possible dereference of NULL"
state = "closed"
created_at = "2024-04-25T14:53:39.886Z"
closed_at = "2024-08-01T08:50:08.380Z"
labels = ["Closed::Invalid", "Storage"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/2311"
host-os = "n/a"
host-arch = "n/a"
qemu-version = "v8.0.5 and upper"
guest-os = "n/a"
guest-arch = "n/a"
description = """There is possible dereference of NULL using macro QEMU_LOCK_GUARD(&q->lock) in:
1) /block/nvme.c line [326](https://github.com/qemu/qemu/blob/5da72194df36535d773c8bdc951529ecd5e31707/block/nvme.c#L326)
2) /include/qemu/ratelimit.h line [45](https://github.com/qemu/qemu/blob/5da72194df36535d773c8bdc951529ecd5e31707/include/qemu/ratelimit.h#L45)
3) /include/qemu/ratelimit.h line [88](https://github.com/qemu/qemu/blob/5da72194df36535d773c8bdc951529ecd5e31707/include/qemu/ratelimit.h#L88)
The QEMU_MAKE_LOCKABLE(x) macro provides a special case (line [71](https://github.com/qemu/qemu/blob/5da72194df36535d773c8bdc951529ecd5e31707/include/qemu/lockable.h#L71) of the lockable.h) if NULL gets into it. Then the macro will return NULL, which will get to the input of the qemu_lockable_auto_lock() function, then to the qemu_lockable_lock() function, where NULL dereference will occur (line [95](https://github.com/qemu/qemu/blob/5da72194df36535d773c8bdc951529ecd5e31707/include/qemu/lockable.h#L95)).
It turns out that the NULL case is provided, but not handled properly. I think a NULL check should be added.
Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author A. Burke."""
reproduce = "n/a"
additional = "n/a"
|