diff mbox

kvm tools: Fix segfault on "lkvm run"

Message ID 1344877885-2942-1-git-send-email-paul104x@yahoo.de (mailing list archive)
State New, archived
Headers show

Commit Message

Paul Neumann Aug. 13, 2012, 5:11 p.m. UTC
The errors from kvm_cmd_run_init() are not handled properly as they are
returned as positive values.

Signed-off-by: Paul Neumann <paul104x@yahoo.de>
---
 tools/kvm/builtin-run.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Asias He Aug. 14, 2012, 1:17 a.m. UTC | #1
[CC'ing Pekka]

Paul,

On Tue, Aug 14, 2012 at 1:11 AM, Paul Neumann <paul104x@yahoo.de> wrote:
> The errors from kvm_cmd_run_init() are not handled properly as they are
> returned as positive values.
>
> Signed-off-by: Paul Neumann <paul104x@yahoo.de>

Looks good to me.  Paul, can you tell how the segfault is triggered as
well? Thanks.

> ---
>  tools/kvm/builtin-run.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/tools/kvm/builtin-run.c b/tools/kvm/builtin-run.c
> index a36bd00..47c6634 100644
> --- a/tools/kvm/builtin-run.c
> +++ b/tools/kvm/builtin-run.c
> @@ -952,7 +952,7 @@ static int kvm_cmd_run_init(int argc, const char **argv)
>                                 fprintf(stderr, "Cannot handle parameter: "
>                                                 "%s\n", argv[0]);
>                                 usage_with_options(run_usage, options);
> -                               return EINVAL;
> +                               return -EINVAL;
>                         }
>                         if (kvm_run_wrapper == KVM_RUN_SANDBOX) {
>                                 /*
> @@ -979,7 +979,7 @@ static int kvm_cmd_run_init(int argc, const char **argv)
>
>         if (!kernel_filename) {
>                 kernel_usage_with_options();
> -               return EINVAL;
> +               return -EINVAL;
>         }
>
>         vmlinux_filename = find_vmlinux();
> --
> 1.7.11.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe kvm" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
Paul Neumann Aug. 14, 2012, 8:47 a.m. UTC | #2
--- Asias He <asias.hejun@gmail.com> schrieb am Di, 14.8.2012:
> Paul,
> 
> On Tue, Aug 14, 2012 at 1:11 AM, Paul Neumann <paul104x@yahoo.de>
> wrote:
> > The errors from kvm_cmd_run_init() are not handled
> properly as they are
> > returned as positive values.
> >
> > Signed-off-by: Paul Neumann <paul104x@yahoo.de>
> 
> Looks good to me.  Paul, can you tell how the segfault
> is triggered as
> well? Thanks.
> 
The segfault is triggered by just running "lkvm run". On my system, it
does not find any kernel, so kvm_cmd_run_init() returns EINVAL which
fails the (r < 0) check in kvm_cmd_run().
Since kvm_cmd_run_init() does not get to initialize the cpus, kvm_cpus
gets mistakenly dereferenced in kvm_cmd_run_work().

Paul
> 
> -- 
> Asias He
> 
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pekka Enberg Aug. 15, 2012, 10:38 a.m. UTC | #3
On Tue, Aug 14, 2012 at 11:47 AM, Paul Neumann <paul104x@yahoo.de> wrote:
>> Looks good to me.  Paul, can you tell how the segfault
>> is triggered as
>> well? Thanks.
>>
> The segfault is triggered by just running "lkvm run". On my system, it
> does not find any kernel, so kvm_cmd_run_init() returns EINVAL which
> fails the (r < 0) check in kvm_cmd_run().
> Since kvm_cmd_run_init() does not get to initialize the cpus, kvm_cpus
> gets mistakenly dereferenced in kvm_cmd_run_work().

Applied with improved changelog. Thanks!
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/tools/kvm/builtin-run.c b/tools/kvm/builtin-run.c
index a36bd00..47c6634 100644
--- a/tools/kvm/builtin-run.c
+++ b/tools/kvm/builtin-run.c
@@ -952,7 +952,7 @@  static int kvm_cmd_run_init(int argc, const char **argv)
 				fprintf(stderr, "Cannot handle parameter: "
 						"%s\n", argv[0]);
 				usage_with_options(run_usage, options);
-				return EINVAL;
+				return -EINVAL;
 			}
 			if (kvm_run_wrapper == KVM_RUN_SANDBOX) {
 				/*
@@ -979,7 +979,7 @@  static int kvm_cmd_run_init(int argc, const char **argv)
 
 	if (!kernel_filename) {
 		kernel_usage_with_options();
-		return EINVAL;
+		return -EINVAL;
 	}
 
 	vmlinux_filename = find_vmlinux();