On Tue, Apr 07, 2026 at 08:01:35PM +0530, Ritesh Harjani (IBM) wrote: > Getting the following kernel panic in papr_hvpipe_dev_create_handle() > when trying to add src_info to the list. > Kernel attempted to write user page (0) - exploit attempt? (uid: 0) > BUG: Kernel NULL pointer dereference on write at 0x00000000 > Faulting instruction address: 0xc0000000001b44a0 > Oops: Kernel access of bad area, sig: 11 [#1] > ... > Call Trace: > papr_hvpipe_dev_ioctl+0x1f4/0x48c (unreliable) > sys_ioctl+0x528/0x1064 > system_call_exception+0x128/0x360 > system_call_vectored_common+0x15c/0x2ec > > The error handling with FD_PREPARE's file cleanup and __free(kfree) auto > cleanup is getting too convoluted. This is mainly because we need to > ensure only 1 user get the srcID handle. To simplify this, we allocate > prepare the src_info in the beginning and add it to the global list > under a spinlock after checking that no duplicates exist. > > This simplify the error handling where if the FD_ADD fails, we can > simply remove the src_info from the list. > > Cc: Christian Brauner <[email protected]> > Fixes: 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to > FD_PREPARE()") > Reported-by: Haren Myneni <[email protected]> > Signed-off-by: Ritesh Harjani (IBM) <[email protected]> > ---
Thanks for fixing this! Reviewed-by: Christian Brauner <[email protected]>
