* [RESEND PATCH v3] bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
@ 2023-02-18 7:23 Zheng Wang
2023-02-18 15:22 ` Coly Li
0 siblings, 1 reply; 2+ messages in thread
From: Zheng Wang @ 2023-02-18 7:23 UTC (permalink / raw)
To: colyli
Cc: hackerzheng666, kent.overstreet, linux-bcache, linux-kernel,
alex000young, Zheng Wang, stable
In some specific situation, the return value of __bch_btree_node_alloc may
be NULL. This may lead to poential NULL pointer dereference in caller
function like a calling chaion :
btree_split->bch_btree_node_alloc->__bch_btree_node_alloc.
Fix it by initialize return value in __bch_btree_node_alloc before return.
Fixes: cafe56359144 ("bcache: A block layer cache")
Cc: stable@vger.kernel.org
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
v3:
- Add Cc: stable@vger.kernel.org suggested by Eric
v2:
- split patch v1 into two patches to make it clearer suggested by Coly Li
---
drivers/md/bcache/btree.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 147c493a989a..cae25e74b9e0 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1090,10 +1090,12 @@ struct btree *__bch_btree_node_alloc(struct cache_set *c, struct btree_op *op,
struct btree *parent)
{
BKEY_PADDED(key) k;
- struct btree *b = ERR_PTR(-EAGAIN);
+ struct btree *b;
mutex_lock(&c->bucket_lock);
retry:
+ /* return ERR_PTR(-EAGAIN) when it fails */
+ b = ERR_PTR(-EAGAIN);
if (__bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, wait))
goto err;
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [RESEND PATCH v3] bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
2023-02-18 7:23 [RESEND PATCH v3] bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent Zheng Wang
@ 2023-02-18 15:22 ` Coly Li
0 siblings, 0 replies; 2+ messages in thread
From: Coly Li @ 2023-02-18 15:22 UTC (permalink / raw)
To: Zheng Wang
Cc: Zheng Hacker, kent.overstreet, linux-bcache, linux-kernel,
alex000young, stable
On Sat, Feb 18, 2023 at 03:23:35PM +0800, Zheng Wang wrote:
> In some specific situation, the return value of __bch_btree_node_alloc may
> be NULL. This may lead to poential NULL pointer dereference in caller
> function like a calling chaion :
> btree_split->bch_btree_node_alloc->__bch_btree_node_alloc.
>
> Fix it by initialize return value in __bch_btree_node_alloc before return.
>
> Fixes: cafe56359144 ("bcache: A block layer cache")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Thanks, I will add this series to my for-next testing queue.
Coly Li
> ---
> v3:
> - Add Cc: stable@vger.kernel.org suggested by Eric
> v2:
> - split patch v1 into two patches to make it clearer suggested by Coly Li
> ---
> drivers/md/bcache/btree.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
> index 147c493a989a..cae25e74b9e0 100644
> --- a/drivers/md/bcache/btree.c
> +++ b/drivers/md/bcache/btree.c
> @@ -1090,10 +1090,12 @@ struct btree *__bch_btree_node_alloc(struct cache_set *c, struct btree_op *op,
> struct btree *parent)
> {
> BKEY_PADDED(key) k;
> - struct btree *b = ERR_PTR(-EAGAIN);
> + struct btree *b;
>
> mutex_lock(&c->bucket_lock);
> retry:
> + /* return ERR_PTR(-EAGAIN) when it fails */
> + b = ERR_PTR(-EAGAIN);
> if (__bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, wait))
> goto err;
>
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-02-18 15:22 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-02-18 7:23 [RESEND PATCH v3] bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent Zheng Wang
2023-02-18 15:22 ` Coly Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).