From: Bart Van Assche <bvanassche@acm.org>
To: Jens Axboe <axboe@kernel.dk>
Cc: linux-block@vger.kernel.org, Christoph Hellwig <hch@lst.de>,
Damien Le Moal <damien.lemoal@wdc.com>,
Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Subject: Re: [PATCH] null_blk: Fix a NULL pointer dereference
Date: Thu, 23 Sep 2021 12:16:01 -0700 [thread overview]
Message-ID: <5bd1b4d6-ae4b-cf5b-a8ce-92bf6d273f85@acm.org> (raw)
In-Reply-To: <043399af-0e2e-6f9a-8422-015c8840907c@kernel.dk>
On 9/23/21 11:53 AM, Jens Axboe wrote:
> I think it's the assumption that poll_queueus == submit_queues. Does this
> work for you?
>
>
> diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
> index eb5cfe189e90..dac88c5daff9 100644
> --- a/drivers/block/null_blk/main.c
> +++ b/drivers/block/null_blk/main.c
> @@ -1748,7 +1757,7 @@ static int setup_queues(struct nullb *nullb)
> int nqueues = nr_cpu_ids;
>
> if (g_poll_queues)
> - nqueues *= 2;
> + nqueues += g_poll_queues;
>
> nullb->queues = kcalloc(nqueues, sizeof(struct nullb_queue),
> GFP_KERNEL);
> @@ -1814,7 +1823,7 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)
> g_submit_queues;
> poll_queues = nullb ? nullb->dev->poll_queues : g_poll_queues;
> if (poll_queues)
> - set->nr_hw_queues *= 2;
> + set->nr_hw_queues += poll_queues;
> set->queue_depth = nullb ? nullb->dev->hw_queue_depth :
> g_hw_queue_depth;
> set->numa_node = nullb ? nullb->dev->home_node : g_home_node;
Hi Jens,
That patch makes test block/020 pass but unfortunately is not sufficient to
make test block/029 pass. This is what is triggered by test block/029:
null_blk: module loaded
==================================================================
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0x2d2/0x820
Read of size 8 at addr 0000000000000128 by task check/6065
CPU: 11 PID: 6065 Comm: check Tainted: G E 5.15.0-rc1-dbg+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
show_stack+0x52/0x58
dump_stack_lvl+0x49/0x5e
kasan_report.cold+0x64/0xdb
kasan_check_range+0x14f/0x1a0
__kasan_check_read+0x11/0x20
blk_mq_map_swqueue+0x2d2/0x820
__blk_mq_update_nr_hw_queues+0x358/0x670
blk_mq_update_nr_hw_queues+0x31/0x50
nullb_device_submit_queues_store+0xc1/0x130 [null_blk]
configfs_write_iter+0x18b/0x220
new_sync_write+0x287/0x390
vfs_write+0x442/0x590
ksys_write+0xbd/0x150
__x64_sys_write+0x42/0x50
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff43deb0367
Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
RSP: 002b:00007ffcabaa5df8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007ff43deb0367
RDX: 0000000000000002 RSI: 000055c2e105a510 RDI: 0000000000000001
RBP: 000055c2e105a510 R08: 000000000000000a R09: 00007ff43df464e0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ff43df83520 R14: 0000000000000002 R15: 00007ff43df83700
==================================================================
prev parent reply other threads:[~2021-09-23 19:16 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-22 17:50 [PATCH] null_blk: Fix a NULL pointer dereference Bart Van Assche
2021-09-22 17:54 ` Jens Axboe
2021-09-22 18:03 ` Bart Van Assche
2021-09-22 18:26 ` Bart Van Assche
2021-09-23 16:04 ` Jens Axboe
2021-09-23 16:22 ` Bart Van Assche
2021-09-23 16:39 ` Jens Axboe
2021-09-23 17:51 ` Bart Van Assche
2021-09-23 17:55 ` Jens Axboe
2021-09-23 18:53 ` Jens Axboe
2021-09-23 19:16 ` Bart Van Assche [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5bd1b4d6-ae4b-cf5b-a8ce-92bf6d273f85@acm.org \
--to=bvanassche@acm.org \
--cc=axboe@kernel.dk \
--cc=chaitanya.kulkarni@wdc.com \
--cc=damien.lemoal@wdc.com \
--cc=hch@lst.de \
--cc=linux-block@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).