All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] block: validate parameters of exported functions
@ 2009-01-10  6:37 Németh Márton
  2009-01-10  6:47 ` Németh Márton
  0 siblings, 1 reply; 2+ messages in thread
From: Németh Márton @ 2009-01-10  6:37 UTC (permalink / raw)
  To: Jens Axboe; +Cc: LKML

From: Márton Németh <nm127@freemail.hu>

Check the parameters of the exported functions in genhd.c agains NULL.
The checks are done with BUG_ON() so they will only act if CONFIG_BUG=y.

Signed-off-by: Márton Németh <nm127@freemail.hu>
---
--- linux-2.6.28/block/genhd.c.orig	2008-12-25 00:26:37.000000000 +0100
+++ linux-2.6.28/block/genhd.c	2009-01-10 07:12:45.000000000 +0100
@@ -58,6 +58,7 @@ struct hd_struct *disk_get_part(struct g

 	if (unlikely(partno < 0))
 		return NULL;
+	BUG_ON(!disk);

 	rcu_read_lock();

@@ -90,6 +91,9 @@ void disk_part_iter_init(struct disk_par
 {
 	struct disk_part_tbl *ptbl;

+	BUG_ON(!piter);
+	BUG_ON(!disk);
+
 	rcu_read_lock();
 	ptbl = rcu_dereference(disk->part_tbl);

@@ -123,6 +127,8 @@ struct hd_struct *disk_part_iter_next(st
 	struct disk_part_tbl *ptbl;
 	int inc, end;

+	BUG_ON(!piter);
+
 	/* put the last partition */
 	disk_put_part(piter->part);
 	piter->part = NULL;
@@ -176,6 +182,7 @@ EXPORT_SYMBOL_GPL(disk_part_iter_next);
  */
 void disk_part_iter_exit(struct disk_part_iter *piter)
 {
+	BUG_ON(!piter);
 	disk_put_part(piter->part);
 	piter->part = NULL;
 }
@@ -201,6 +208,8 @@ struct hd_struct *disk_map_sector_rcu(st
 	struct disk_part_tbl *ptbl;
 	int i;

+	BUG_ON(!disk);
+
 	ptbl = rcu_dereference(disk->part_tbl);

 	for (i = 1; i < ptbl->len; i++) {
@@ -375,6 +384,9 @@ int blk_alloc_devt(struct hd_struct *par
 	struct gendisk *disk = part_to_disk(part);
 	int idx, rc;

+	BUG_ON(!part);
+	BUG_ON(!devt);
+
 	/* in consecutive minor range? */
 	if (part->partno < disk->minors) {
 		*devt = MKDEV(disk->major, disk->first_minor + part->partno);
@@ -487,6 +499,8 @@ void add_disk(struct gendisk *disk)
 	dev_t devt;
 	int retval;

+	BUG_ON(!disk);
+
 	/* minors == 0 indicates to use ext devt from part0 and should
 	 * be accompanied with EXT_DEVT flag.  Make sure all
 	 * parameters make sense.
@@ -526,6 +540,8 @@ EXPORT_SYMBOL(del_gendisk);	/* in partit

 void unlink_gendisk(struct gendisk *disk)
 {
+	BUG_ON(!disk);
+	BUG_ON(!disk->queue);
 	sysfs_remove_link(&disk_to_dev(disk)->kobj, "bdi");
 	bdi_unregister(&disk->queue->backing_dev_info);
 	blk_unregister_queue(disk);
@@ -544,6 +560,8 @@ struct gendisk *get_gendisk(dev_t devt,
 {
 	struct gendisk *disk = NULL;

+	BUG_ON(!partno);
+
 	if (MAJOR(devt) != BLOCK_EXT_MAJOR) {
 		struct kobject *kobj;

@@ -1127,6 +1145,8 @@ struct kobject *get_disk(struct gendisk
 	struct module *owner;
 	struct kobject *kobj;

+	BUG_ON(!disk);
+
 	if (!disk->fops)
 		return NULL;
 	owner = disk->fops->owner;
@@ -1153,6 +1173,7 @@ EXPORT_SYMBOL(put_disk);

 void set_device_ro(struct block_device *bdev, int flag)
 {
+	BUG_ON(!bdev);
 	bdev->bd_part->policy = flag;
 }


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] block: validate parameters of exported functions
  2009-01-10  6:37 [PATCH] block: validate parameters of exported functions Németh Márton
@ 2009-01-10  6:47 ` Németh Márton
  0 siblings, 0 replies; 2+ messages in thread
From: Németh Márton @ 2009-01-10  6:47 UTC (permalink / raw)
  To: Jens Axboe; +Cc: LKML

Németh Márton wrote:
> From: Márton Németh <nm127@freemail.hu>
> 
> Check the parameters of the exported functions in genhd.c agains NULL.
> The checks are done with BUG_ON() so they will only act if CONFIG_BUG=y.
> 
> Signed-off-by: Márton Németh <nm127@freemail.hu>

The following simple module can trigger the BUG_ON(!disk->queue) condition
in unlink_gendisk() when the module is unloaded. The problem seems to be
that after alloc_disk() call the disk->queue is NULL. The inside the
del_disk() call this condition is not checked and the BUG_ON() will be
triggered:

#include <linux/module.h>
#include <linux/genhd.h>

MODULE_AUTHOR("Márton Németh <nm127@freemail.hu>");
MODULE_DESCRIPTION("Test alloc_disk");
MODULE_LICENSE("GPL");

static struct gendisk *gd_ptr;

static int test_init_module(void)
{
	printk(KERN_DEBUG "starting module\n");

	gd_ptr = alloc_disk(1);
	if (!gd_ptr) {
		return -ENOMEM;
	}
	printk(KERN_DEBUG "gd_ptr after alloc=%p\n", gd_ptr);

	return 0;
}


static void test_exit_module(void)
{
	printk(KERN_DEBUG "unloading module\n");

	del_gendisk(gd_ptr);
}

module_init(test_init_module);
module_exit(test_exit_module);


[  137.688075] starting module
[  137.688101] gd_ptr after alloc=f4e36d48
[  148.978208] unloading module
[  148.978289] ------------[ cut here ]------------
[  148.978298] kernel BUG at block/genhd.c:544!
[  148.978305] invalid opcode: 0000 [#1] PREEMPT
[  148.978315] last sysfs file: /sys/class/power_supply/BAT0/charge_full
[  148.978322] Modules linked in: test_alloc_disk(-) ppdev lp cpufreq_ondemand cpufreq_conservative ipv6 xt_tcpudp iptable_filter ip_tables x_tables
leds_clevo_mail led_class via via_agp drm agpgart eeprom snd_pcm_oss snd_mixer_oss cpufreq_userspace cpufreq_powersave powernow_k8 fan snd_via82xx_modem
snd_via82xx mousedev snd_ac97_codec snd_mpu401_uart snd_seq_midi snd_seq_midi_event ac97_bus snd_rawmidi snd_pcm snd_seq pcmcia firmware_class snd_timer
snd_seq_device snd ide_cd_mod i2c_viapro snd_page_alloc psmouse serio_raw pcspkr soundcore k8temp hwmon cdrom i2c_core ehci_hcd uhci_hcd 8139too mii bitrev
crc32 usbcore yenta_socket rsrc_nonstatic pcmcia_core video backlight output 8250_pnp 8250 serial_core parport_pc parport battery ac thermal button processor evdev
[  148.978472]
[  148.978480] Pid: 4564, comm: rmmod Not tainted (2.6.28 #5) K8N800
[  148.978488] EIP: 0060:[<c0234868>] EFLAGS: 00210246 CPU: 0
[  148.978502] EIP is at unlink_gendisk+0x58/0x60
[  148.978509] EAX: 00000000 EBX: f4e36d48 ECX: f4f146e0 EDX: 00000000
[  148.978516] ESI: f4e36d48 EDI: f4e36f90 EBP: f60ddf1c ESP: f60ddf18
[  148.978524]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[  148.978531] Process rmmod (pid: 4564, ti=f60dc000 task=f4f146e0 task.ti=f60dc000)
[  148.978537] Stack:
[  148.978541]  00000000 f60ddf40 c01cd344 f4e36d48 00000000 00000000 00000003 00000000
[  148.978559]  f815a400 00000000 f60ddf4c f815a01c f815a088 f60ddfb0 c014f1e8 f815a40c
[  148.978578]  74736574 6c6c615f 645f636f 006b7369 ffffffff b80be000 b80be000 00000000
[  148.978599] Call Trace:
[  148.978604]  [<c01cd344>] ? del_gendisk+0x84/0xd0
[  148.978617]  [<f815a01c>] ? test_exit_module+0x1c/0x20 [test_alloc_disk]
[  148.978632]  [<c014f1e8>] ? sys_delete_module+0x158/0x220
[  148.978646]  [<c0103407>] ? sysenter_exit+0xf/0x16
[  148.978658]  [<c01033d9>] ? sysenter_do_call+0x12/0x31
[  148.978667] Code: 00 00 e8 1c da f3 ff 89 d8 e8 c5 c1 ff ff 8b 4b 08 8b 93 28 02 00 00 a1 dc 35 84 c0 e8 62 03 07 00 5b 5d c3 0f 0b eb fe 8d 76 00 <0f> 0b eb
fe 8d 74 26 00 55 89 e5 53 89 d3 83 ec 10 8b 55 10 89
[  148.978773] EIP: [<c0234868>] unlink_gendisk+0x58/0x60 SS:ESP 0068:f60ddf18
[  148.978788] ---[ end trace 4e6bc6983f47e922 ]---

Regards,

	Márton Németh

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2009-01-10  6:47 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-01-10  6:37 [PATCH] block: validate parameters of exported functions Németh Márton
2009-01-10  6:47 ` Németh Márton

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.