Linux-Block Archive on lore.kernel.org
 help / color / Atom feed
From: Bart Van Assche <bvanassche@acm.org>
To: Dongli Zhang <dongli.zhang@oracle.com>,
	syzbot <syzbot+313d95e8a7a49263f88d@syzkaller.appspotmail.com>,
	axboe@kernel.dk, linux-block@vger.kernel.org,
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
Date: Thu, 26 Mar 2020 19:52:06 -0700
Message-ID: <523c2b61-476e-0fb6-12d9-37038d150fb7@acm.org> (raw)
In-Reply-To: <ffabca27-309e-4a6e-eac2-d03a56a7493a@oracle.com>

On 2020-03-26 17:19, Dongli Zhang wrote:
> I think the issue is because of line 2827, that is, the q->nr_hw_queues is
> updated too earlier. It is still possible the init would fail later.
> 
> 2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
> 2810                                                 struct request_queue *q)
> 2811 {
> 2812         int i, j, end;
> 2813         struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
> 2814
> 2815         if (q->nr_hw_queues < set->nr_hw_queues) {
> 2816                 struct blk_mq_hw_ctx **new_hctxs;
> 2817
> 2818                 new_hctxs = kcalloc_node(set->nr_hw_queues,
> 2819                                        sizeof(*new_hctxs), GFP_KERNEL,
> 2820                                        set->numa_node);
> 2821                 if (!new_hctxs)
> 2822                         return;
> 2823                 if (hctxs)
> 2824                         memcpy(new_hctxs, hctxs, q->nr_hw_queues *
> 2825                                sizeof(*hctxs));
> 2826                 q->queue_hw_ctx = new_hctxs;
> 2827                 q->nr_hw_queues = set->nr_hw_queues;
> 2828                 kfree(hctxs);
> 2829                 hctxs = new_hctxs;
> 2830         }

Which kernel tree does this syzbot report refer to? Commit
d0930bb8f46b ("blk-mq: Fix a recently introduced regression in
blk_mq_realloc_hw_ctxs()") in Jens' tree removed line 2827 shown above.

Thanks,

Bart.

  reply index

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-26 19:33 syzbot
2020-03-27  0:19 ` Dongli Zhang
2020-03-27  2:52   ` Bart Van Assche [this message]
2020-03-27 13:30     ` Dongli Zhang
2020-03-27  1:28 ` syzbot
2020-03-27  3:00   ` Bart Van Assche
2020-03-27 15:06   ` Jens Axboe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=523c2b61-476e-0fb6-12d9-37038d150fb7@acm.org \
    --to=bvanassche@acm.org \
    --cc=axboe@kernel.dk \
    --cc=dongli.zhang@oracle.com \
    --cc=linux-block@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+313d95e8a7a49263f88d@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Block Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-block/0 linux-block/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-block linux-block/ https://lore.kernel.org/linux-block \
		linux-block@vger.kernel.org
	public-inbox-index linux-block

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-block


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git