[PATCH] powerpc/pseries/papr-hvpipe: fix NULL dereference in handle creation
Greg KH
gregkh at linuxfoundation.org
Mon Apr 20 19:44:24 AEST 2026
On Mon, Apr 20, 2026 at 05:38:56PM +0800, Guangshuo Li wrote:
> papr_hvpipe_dev_create_handle() transfers ownership of src_info with
> retain_and_null_ptr(src_info) after anon_inode_getfile() succeeds.
> However, retain_and_null_ptr() clears src_info immediately, and the
> function then still dereferences src_info in the subsequent list_add().
>
> Store the transferred pointer in a separate variable and use that for
> the list insertion.
>
> Manually identified during code review.
>
> Fixes: 6d3789d347a7af5c4b0b2da3af47b8d9da607ab2 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()")
Please use the proper notation here, as the documentation asks you to.
thanks,
greg k-h
More information about the Linuxppc-dev
mailing list