* [PATCH] block: validate parameters of exported functions
@ 2009-01-10 6:37 Németh Márton
2009-01-10 6:47 ` Németh Márton
0 siblings, 1 reply; 2+ messages in thread
From: Németh Márton @ 2009-01-10 6:37 UTC (permalink / raw)
To: Jens Axboe; +Cc: LKML
From: Márton Németh <nm127@freemail.hu>
Check the parameters of the exported functions in genhd.c agains NULL.
The checks are done with BUG_ON() so they will only act if CONFIG_BUG=y.
Signed-off-by: Márton Németh <nm127@freemail.hu>
---
--- linux-2.6.28/block/genhd.c.orig 2008-12-25 00:26:37.000000000 +0100
+++ linux-2.6.28/block/genhd.c 2009-01-10 07:12:45.000000000 +0100
@@ -58,6 +58,7 @@ struct hd_struct *disk_get_part(struct g
if (unlikely(partno < 0))
return NULL;
+ BUG_ON(!disk);
rcu_read_lock();
@@ -90,6 +91,9 @@ void disk_part_iter_init(struct disk_par
{
struct disk_part_tbl *ptbl;
+ BUG_ON(!piter);
+ BUG_ON(!disk);
+
rcu_read_lock();
ptbl = rcu_dereference(disk->part_tbl);
@@ -123,6 +127,8 @@ struct hd_struct *disk_part_iter_next(st
struct disk_part_tbl *ptbl;
int inc, end;
+ BUG_ON(!piter);
+
/* put the last partition */
disk_put_part(piter->part);
piter->part = NULL;
@@ -176,6 +182,7 @@ EXPORT_SYMBOL_GPL(disk_part_iter_next);
*/
void disk_part_iter_exit(struct disk_part_iter *piter)
{
+ BUG_ON(!piter);
disk_put_part(piter->part);
piter->part = NULL;
}
@@ -201,6 +208,8 @@ struct hd_struct *disk_map_sector_rcu(st
struct disk_part_tbl *ptbl;
int i;
+ BUG_ON(!disk);
+
ptbl = rcu_dereference(disk->part_tbl);
for (i = 1; i < ptbl->len; i++) {
@@ -375,6 +384,9 @@ int blk_alloc_devt(struct hd_struct *par
struct gendisk *disk = part_to_disk(part);
int idx, rc;
+ BUG_ON(!part);
+ BUG_ON(!devt);
+
/* in consecutive minor range? */
if (part->partno < disk->minors) {
*devt = MKDEV(disk->major, disk->first_minor + part->partno);
@@ -487,6 +499,8 @@ void add_disk(struct gendisk *disk)
dev_t devt;
int retval;
+ BUG_ON(!disk);
+
/* minors == 0 indicates to use ext devt from part0 and should
* be accompanied with EXT_DEVT flag. Make sure all
* parameters make sense.
@@ -526,6 +540,8 @@ EXPORT_SYMBOL(del_gendisk); /* in partit
void unlink_gendisk(struct gendisk *disk)
{
+ BUG_ON(!disk);
+ BUG_ON(!disk->queue);
sysfs_remove_link(&disk_to_dev(disk)->kobj, "bdi");
bdi_unregister(&disk->queue->backing_dev_info);
blk_unregister_queue(disk);
@@ -544,6 +560,8 @@ struct gendisk *get_gendisk(dev_t devt,
{
struct gendisk *disk = NULL;
+ BUG_ON(!partno);
+
if (MAJOR(devt) != BLOCK_EXT_MAJOR) {
struct kobject *kobj;
@@ -1127,6 +1145,8 @@ struct kobject *get_disk(struct gendisk
struct module *owner;
struct kobject *kobj;
+ BUG_ON(!disk);
+
if (!disk->fops)
return NULL;
owner = disk->fops->owner;
@@ -1153,6 +1173,7 @@ EXPORT_SYMBOL(put_disk);
void set_device_ro(struct block_device *bdev, int flag)
{
+ BUG_ON(!bdev);
bdev->bd_part->policy = flag;
}
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] block: validate parameters of exported functions
2009-01-10 6:37 [PATCH] block: validate parameters of exported functions Németh Márton
@ 2009-01-10 6:47 ` Németh Márton
0 siblings, 0 replies; 2+ messages in thread
From: Németh Márton @ 2009-01-10 6:47 UTC (permalink / raw)
To: Jens Axboe; +Cc: LKML
Németh Márton wrote:
> From: Márton Németh <nm127@freemail.hu>
>
> Check the parameters of the exported functions in genhd.c agains NULL.
> The checks are done with BUG_ON() so they will only act if CONFIG_BUG=y.
>
> Signed-off-by: Márton Németh <nm127@freemail.hu>
The following simple module can trigger the BUG_ON(!disk->queue) condition
in unlink_gendisk() when the module is unloaded. The problem seems to be
that after alloc_disk() call the disk->queue is NULL. The inside the
del_disk() call this condition is not checked and the BUG_ON() will be
triggered:
#include <linux/module.h>
#include <linux/genhd.h>
MODULE_AUTHOR("Márton Németh <nm127@freemail.hu>");
MODULE_DESCRIPTION("Test alloc_disk");
MODULE_LICENSE("GPL");
static struct gendisk *gd_ptr;
static int test_init_module(void)
{
printk(KERN_DEBUG "starting module\n");
gd_ptr = alloc_disk(1);
if (!gd_ptr) {
return -ENOMEM;
}
printk(KERN_DEBUG "gd_ptr after alloc=%p\n", gd_ptr);
return 0;
}
static void test_exit_module(void)
{
printk(KERN_DEBUG "unloading module\n");
del_gendisk(gd_ptr);
}
module_init(test_init_module);
module_exit(test_exit_module);
[ 137.688075] starting module
[ 137.688101] gd_ptr after alloc=f4e36d48
[ 148.978208] unloading module
[ 148.978289] ------------[ cut here ]------------
[ 148.978298] kernel BUG at block/genhd.c:544!
[ 148.978305] invalid opcode: 0000 [#1] PREEMPT
[ 148.978315] last sysfs file: /sys/class/power_supply/BAT0/charge_full
[ 148.978322] Modules linked in: test_alloc_disk(-) ppdev lp cpufreq_ondemand cpufreq_conservative ipv6 xt_tcpudp iptable_filter ip_tables x_tables
leds_clevo_mail led_class via via_agp drm agpgart eeprom snd_pcm_oss snd_mixer_oss cpufreq_userspace cpufreq_powersave powernow_k8 fan snd_via82xx_modem
snd_via82xx mousedev snd_ac97_codec snd_mpu401_uart snd_seq_midi snd_seq_midi_event ac97_bus snd_rawmidi snd_pcm snd_seq pcmcia firmware_class snd_timer
snd_seq_device snd ide_cd_mod i2c_viapro snd_page_alloc psmouse serio_raw pcspkr soundcore k8temp hwmon cdrom i2c_core ehci_hcd uhci_hcd 8139too mii bitrev
crc32 usbcore yenta_socket rsrc_nonstatic pcmcia_core video backlight output 8250_pnp 8250 serial_core parport_pc parport battery ac thermal button processor evdev
[ 148.978472]
[ 148.978480] Pid: 4564, comm: rmmod Not tainted (2.6.28 #5) K8N800
[ 148.978488] EIP: 0060:[<c0234868>] EFLAGS: 00210246 CPU: 0
[ 148.978502] EIP is at unlink_gendisk+0x58/0x60
[ 148.978509] EAX: 00000000 EBX: f4e36d48 ECX: f4f146e0 EDX: 00000000
[ 148.978516] ESI: f4e36d48 EDI: f4e36f90 EBP: f60ddf1c ESP: f60ddf18
[ 148.978524] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[ 148.978531] Process rmmod (pid: 4564, ti=f60dc000 task=f4f146e0 task.ti=f60dc000)
[ 148.978537] Stack:
[ 148.978541] 00000000 f60ddf40 c01cd344 f4e36d48 00000000 00000000 00000003 00000000
[ 148.978559] f815a400 00000000 f60ddf4c f815a01c f815a088 f60ddfb0 c014f1e8 f815a40c
[ 148.978578] 74736574 6c6c615f 645f636f 006b7369 ffffffff b80be000 b80be000 00000000
[ 148.978599] Call Trace:
[ 148.978604] [<c01cd344>] ? del_gendisk+0x84/0xd0
[ 148.978617] [<f815a01c>] ? test_exit_module+0x1c/0x20 [test_alloc_disk]
[ 148.978632] [<c014f1e8>] ? sys_delete_module+0x158/0x220
[ 148.978646] [<c0103407>] ? sysenter_exit+0xf/0x16
[ 148.978658] [<c01033d9>] ? sysenter_do_call+0x12/0x31
[ 148.978667] Code: 00 00 e8 1c da f3 ff 89 d8 e8 c5 c1 ff ff 8b 4b 08 8b 93 28 02 00 00 a1 dc 35 84 c0 e8 62 03 07 00 5b 5d c3 0f 0b eb fe 8d 76 00 <0f> 0b eb
fe 8d 74 26 00 55 89 e5 53 89 d3 83 ec 10 8b 55 10 89
[ 148.978773] EIP: [<c0234868>] unlink_gendisk+0x58/0x60 SS:ESP 0068:f60ddf18
[ 148.978788] ---[ end trace 4e6bc6983f47e922 ]---
Regards,
Márton Németh
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-01-10 6:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-01-10 6:37 [PATCH] block: validate parameters of exported functions Németh Márton
2009-01-10 6:47 ` Németh Márton
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.