Re: [PATCH] null_blk: Fix a NULL pointer dereference

From: Bart Van Assche <bvanassche@acm.org>
To: Jens Axboe <axboe@kernel.dk>
Cc: linux-block@vger.kernel.org, Christoph Hellwig <hch@lst.de>,
	Damien Le Moal <damien.lemoal@wdc.com>,
	Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Subject: Re: [PATCH] null_blk: Fix a NULL pointer dereference
Date: Thu, 23 Sep 2021 12:16:01 -0700	[thread overview]
Message-ID: <5bd1b4d6-ae4b-cf5b-a8ce-92bf6d273f85@acm.org> (raw)
In-Reply-To: <043399af-0e2e-6f9a-8422-015c8840907c@kernel.dk>

On 9/23/21 11:53 AM, Jens Axboe wrote:
> I think it's the assumption that poll_queueus == submit_queues. Does this
> work for you?
> 
> 
> diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
> index eb5cfe189e90..dac88c5daff9 100644
> --- a/drivers/block/null_blk/main.c
> +++ b/drivers/block/null_blk/main.c
> @@ -1748,7 +1757,7 @@ static int setup_queues(struct nullb *nullb)
>   	int nqueues = nr_cpu_ids;
>   
>   	if (g_poll_queues)
> -		nqueues *= 2;
> +		nqueues += g_poll_queues;
>   
>   	nullb->queues = kcalloc(nqueues, sizeof(struct nullb_queue),
>   				GFP_KERNEL);
> @@ -1814,7 +1823,7 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)
>   						g_submit_queues;
>   	poll_queues = nullb ? nullb->dev->poll_queues : g_poll_queues;
>   	if (poll_queues)
> -		set->nr_hw_queues *= 2;
> +		set->nr_hw_queues += poll_queues;
>   	set->queue_depth = nullb ? nullb->dev->hw_queue_depth :
>   						g_hw_queue_depth;
>   	set->numa_node = nullb ? nullb->dev->home_node : g_home_node;

Hi Jens,

That patch makes test block/020 pass but unfortunately is not sufficient to
make test block/029 pass. This is what is triggered by test block/029:

null_blk: module loaded
==================================================================
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0x2d2/0x820
Read of size 8 at addr 0000000000000128 by task check/6065

CPU: 11 PID: 6065 Comm: check Tainted: G            E     5.15.0-rc1-dbg+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
  show_stack+0x52/0x58
  dump_stack_lvl+0x49/0x5e
  kasan_report.cold+0x64/0xdb
  kasan_check_range+0x14f/0x1a0
  __kasan_check_read+0x11/0x20
  blk_mq_map_swqueue+0x2d2/0x820
  __blk_mq_update_nr_hw_queues+0x358/0x670
  blk_mq_update_nr_hw_queues+0x31/0x50
  nullb_device_submit_queues_store+0xc1/0x130 [null_blk]
  configfs_write_iter+0x18b/0x220
  new_sync_write+0x287/0x390
  vfs_write+0x442/0x590
  ksys_write+0xbd/0x150
  __x64_sys_write+0x42/0x50
  do_syscall_64+0x35/0xb0
  entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff43deb0367
Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
RSP: 002b:00007ffcabaa5df8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007ff43deb0367
RDX: 0000000000000002 RSI: 000055c2e105a510 RDI: 0000000000000001
RBP: 000055c2e105a510 R08: 000000000000000a R09: 00007ff43df464e0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ff43df83520 R14: 0000000000000002 R15: 00007ff43df83700
==================================================================