[Xen-changelog] [xen master] credit2: avoid NULL deref in csched2_res_pick() when tracing

[patchbot@xxxxxxx]

commit 8824fd3871a2ded6bee0f48785bf539aff46a771
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Mar 3 16:01:30 2020 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Mar 3 16:01:30 2020 +0100

    credit2: avoid NULL deref in csched2_res_pick() when tracing
    
    The issue here results from one of the downsides of using goto: The
    early "goto out" and "goto out_up" in the function very clearly bypass
    any possible initialization of min_rqd, yet the tracing code at the end
    of the function consumes the value. There's even a comment regarding the
    trace record not being accurate in this case.
    
    CID: 1460432
    Fixes: 9c84bc004653 ("sched: rework credit2 run-queue allocation")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Juergen Gross <jgross@xxxxxxxx>
    Acked-by: Dario Faggioli <dfaggioli@xxxxxxxx>
---
 xen/common/sched/credit2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/common/sched/credit2.c b/xen/common/sched/credit2.c
index 8ae3b80d2e..c7241944a8 100644
--- a/xen/common/sched/credit2.c
+++ b/xen/common/sched/credit2.c
@@ -2403,7 +2403,7 @@ csched2_res_pick(const struct scheduler *ops, const 
struct sched_unit *unit)
         } d;
         d.dom = unit->domain->domain_id;
         d.unit = unit->unit_id;
-        d.rq_id = min_rqd->id;
+        d.rq_id = min_rqd ? min_rqd->id : -1;
         d.b_avgload = min_avgload;
         d.new_cpu = new_cpu;
         __trace_var(TRC_CSCHED2_PICKED_CPU, 1,
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog