From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Mikulas Patocka <mpatocka@redhat.com>,
Tejun Heo <tj@kernel.org>, Jens Axboe <axboe@kernel.dk>
Subject: [PATCH 3.10 63/80] block: fix a probe argument to blk_register_region
Date: Tue, 26 Nov 2013 16:57:32 -0800 [thread overview]
Message-ID: <20131127005645.313967908@linuxfoundation.org> (raw)
In-Reply-To: <20131127005640.934155527@linuxfoundation.org>
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit a207f5937630dd35bd2550620bef416937a1365e upstream.
The probe function is supposed to return NULL on failure (as we can see in
kobj_lookup: kobj = probe(dev, index, data); ... if (kobj) return kobj;
However, in loop and brd, it returns negative error from ERR_PTR.
This causes a crash if we simulate disk allocation failure and run
less -f /dev/loop0 because the negative number is interpreted as a pointer:
BUG: unable to handle kernel NULL pointer dereference at 00000000000002b4
IP: [<ffffffff8118b188>] __blkdev_get+0x28/0x450
PGD 23c677067 PUD 23d6d1067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: loop hpfs nvidia(PO) ip6table_filter ip6_tables uvesafb cfbcopyarea cfbimgblt cfbfillrect fbcon font bitblit fbcon_rotate fbcon_cw fbcon_ud fbcon_ccw softcursor fb fbdev msr ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp llc tun ipv6 cpufreq_stats cpufreq_ondemand cpufreq_userspace cpufreq_powersave cpufreq_conservative hid_generic spadfs usbhid hid fuse raid0 snd_usb_audio snd_pcm_oss snd_mixer_oss md_mod snd_pcm snd_timer snd_page_alloc snd_hwdep snd_usbmidi_lib dmi_sysfs snd_rawmidi nf_nat_ftp nf_nat nf_conntrack_ftp nf_conntrack snd soundcore lm85 hwmon_vid ohci_hcd ehci_pci ehci_hcd serverworks sata_svw libata acpi_cpufreq freq_table mperf ide_core usbcore kvm_amd kvm tg3 i2c_piix4 libphy microcode e100 usb_common ptp skge i2c_core pcspkr k10temp evdev floppy hwmon pps_core mii rtc_cmos button processor unix [last unloaded: nvidia]
CPU: 1 PID: 6831 Comm: less Tainted: P W O 3.10.15-devel #18
Hardware name: empty empty/S3992-E, BIOS 'V1.06 ' 06/09/2009
task: ffff880203cc6bc0 ti: ffff88023e47c000 task.ti: ffff88023e47c000
RIP: 0010:[<ffffffff8118b188>] [<ffffffff8118b188>] __blkdev_get+0x28/0x450
RSP: 0018:ffff88023e47dbd8 EFLAGS: 00010286
RAX: ffffffffffffff74 RBX: ffffffffffffff74 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffff88023e47dc18 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88023f519658
R13: ffffffff8118c300 R14: 0000000000000000 R15: ffff88023f519640
FS: 00007f2070bf7700(0000) GS:ffff880247400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000002b4 CR3: 000000023da1d000 CR4: 00000000000007e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Stack:
0000000000000002 0000001d00000000 000000003e47dc50 ffff88023f519640
ffff88043d5bb668 ffffffff8118c300 ffff88023d683550 ffff88023e47de60
ffff88023e47dc98 ffffffff8118c10d 0000001d81605698 0000000000000292
Call Trace:
[<ffffffff8118c300>] ? blkdev_get_by_dev+0x60/0x60
[<ffffffff8118c10d>] blkdev_get+0x1dd/0x370
[<ffffffff8118c300>] ? blkdev_get_by_dev+0x60/0x60
[<ffffffff813cea6c>] ? _raw_spin_unlock+0x2c/0x50
[<ffffffff8118c300>] ? blkdev_get_by_dev+0x60/0x60
[<ffffffff8118c365>] blkdev_open+0x65/0x80
[<ffffffff8114d12e>] do_dentry_open.isra.18+0x23e/0x2f0
[<ffffffff8114d214>] finish_open+0x34/0x50
[<ffffffff8115e122>] do_last.isra.62+0x2d2/0xc50
[<ffffffff8115eb58>] path_openat.isra.63+0xb8/0x4d0
[<ffffffff81115a8e>] ? might_fault+0x4e/0xa0
[<ffffffff8115f4f0>] do_filp_open+0x40/0x90
[<ffffffff813cea6c>] ? _raw_spin_unlock+0x2c/0x50
[<ffffffff8116db85>] ? __alloc_fd+0xa5/0x1f0
[<ffffffff8114e45f>] do_sys_open+0xef/0x1d0
[<ffffffff8114e559>] SyS_open+0x19/0x20
[<ffffffff813cff16>] system_call_fastpath+0x1a/0x1f
Code: 44 00 00 55 48 89 e5 41 57 49 89 ff 41 56 41 89 d6 41 55 41 54 4c 8d 67 18 53 48 83 ec 18 89 75 cc e9 f2 00 00 00 0f 1f 44 00 00 <48> 8b 80 40 03 00 00 48 89 df 4c 8b 68 58 e8 d5
a4 07 00 44 89
RIP [<ffffffff8118b188>] __blkdev_get+0x28/0x450
RSP <ffff88023e47dbd8>
CR2: 00000000000002b4
---[ end trace bb7f32dbf02398dc ]---
The brd change should be backported to stable kernels starting with 2.6.25.
The loop change should be backported to stable kernels starting with 2.6.22.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/brd.c | 2 +-
drivers/block/loop.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -545,7 +545,7 @@ static struct kobject *brd_probe(dev_t d
mutex_lock(&brd_devices_mutex);
brd = brd_init_one(MINOR(dev) >> part_shift);
- kobj = brd ? get_disk(brd->brd_disk) : ERR_PTR(-ENOMEM);
+ kobj = brd ? get_disk(brd->brd_disk) : NULL;
mutex_unlock(&brd_devices_mutex);
*part = 0;
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1741,7 +1741,7 @@ static struct kobject *loop_probe(dev_t
if (err < 0)
err = loop_add(&lo, MINOR(dev) >> part_shift);
if (err < 0)
- kobj = ERR_PTR(err);
+ kobj = NULL;
else
kobj = get_disk(lo->lo_disk);
mutex_unlock(&loop_index_mutex);
next prev parent reply other threads:[~2013-11-27 1:46 UTC|newest]
Thread overview: 84+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-11-27 0:56 [PATCH 3.10 00/80] 3.10.21-stable review Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 01/80] ACPICA: DeRefOf operator: Update to fully resolve FieldUnit and BufferField refs Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 02/80] libertas: potential oops in debugfs Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 03/80] aacraid: prevent invalid pointer dereference Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 04/80] ACPICA: Return error if DerefOf resolves to a null package element Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 05/80] ACPICA: Fix for a Store->ArgX when ArgX contains a reference to a field Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 06/80] USB: mos7840: fix tiocmget error handling Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 07/80] can: kvaser_usb: fix usb endpoints detection Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 08/80] crypto: ansi_cprng - Fix off by one error in non-block size request Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 09/80] crypto: s390 - Fix aes-cbc IV corruption Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 10/80] can: c_can: Fix RX message handling, handle lost message before EOB Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 11/80] ipc,shm: correct error return value in shmctl (SHM_UNLOCK) Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 12/80] ipc,shm: fix shm_file deletion races Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 13/80] drm/nv50-/disp: remove dcb_outp_match call, and related variables Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 14/80] drm/nva3-/disp: fix hda eld writing, needs to be padded Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 15/80] SUNRPC: dont map EKEYEXPIRED to EACCES in call_refreshresult Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 16/80] sched, idle: Fix the idle polling state logic Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 17/80] PCI: Allow PCIe Capability link-related register access for switches Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 18/80] PCI: Remove PCIe Capability version checks Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 19/80] PCI: Support PCIe Capability Slot registers only for ports with slots Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 20/80] perf/ftrace: Fix paranoid level for enabling function tracer Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 21/80] ACPI / EC: Ensure lock is acquired before accessing ec struct members Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 22/80] ACPI / video: Quirk initial backlight level 0 Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 23/80] ACPI / hotplug: Fix handle_root_bridge_removal() Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 24/80] ACPI / hotplug: Do not execute "insert in progress" _OST Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 25/80] rt2x00: fix a crash bug in the HT descriptor handling fix Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 26/80] rt2x00: check if device is still available on rt2x00mac_flush() Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 27/80] rt2x00: rt2800lib: fix VGC adjustment for RT5592 Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 28/80] rt2x00: fix HT TX descriptor settings regression Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 29/80] Revert "ima: policy for RAMFS" Greg Kroah-Hartman
2013-11-27 0:56 ` [PATCH 3.10 30/80] exec/ptrace: fix get_dumpable() incorrect tests Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 31/80] ALSA: 6fire: Fix probe of multiple cards Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 32/80] ALSA: compress: fix drain calls blocking other compress functions Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 33/80] ALSA: compress: fix drain calls blocking other compress functions (v6) Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 34/80] ALSA: msnd: Avoid duplicated driver name Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 35/80] ALSA: hda - Add support of ALC255 codecs Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 36/80] ALSA: hda - Enable SPDIF for Acer TravelMate 6293 Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 37/80] ALSA: hda - Make sure mute LEDs stay on during runtime suspend (Realtek) Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 38/80] ALSA: hda - Add support for CX20952 Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 39/80] ALSA: hda - Add pincfg fixup for ASUS W5A Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 40/80] ALSA: hda - Fix Line Out automute on Realtek multifunction jacks Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 41/80] ALSA: hda - Check keep_eapd_on before inv_eapd Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 42/80] ALSA: hda - Dont turn off EAPD for headphone on Lenovo N100 Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 43/80] ALSA: hda - Dont clear the power state at snd_hda_codec_reset() Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 44/80] ALSA: hda - Fix unbalanced runtime PM notification at resume Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 45/80] ALSA: hda - Fix the headphone jack detection on Sony VAIO TX Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 46/80] ALSA: hda - Add headset quirk for Dell Inspiron 3135 Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 47/80] ALSA: hda - Provide missing pin configs for VAIO with ALC260 Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 48/80] NFSv4: Fix a use-after-free situation in _nfs4_proc_getlk() Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 49/80] NFSv4: fix NULL dereference in open recover Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 50/80] NFSv4: dont fail on missing fattr " Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 51/80] NFSv4: dont reprocess cached open CLAIM_PREVIOUS Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 52/80] NFSv4: Fix state reference counting in _nfs4_opendata_reclaim_to_nfs4_state Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 53/80] nfsd: return better errors to exportfs Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 54/80] nfsd: split up nfsd_setattr Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 55/80] nfsd: make sure to balance get/put_write_access Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 56/80] x86/microcode/amd: Tone down printk(), dont treat a missing firmware file as an error Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 57/80] KVM: x86: fix emulation of "movzbl %bpl, %eax" Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 58/80] ftrace/x86: skip over the breakpoint for ftrace caller Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 59/80] KVM: IOMMU: hva align mapping page size Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 60/80] arm/arm64: KVM: Fix hyp mappings of vmalloc regions Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 61/80] hwmon: (lm90) Fix max6696 alarm handling Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 62/80] block: fix race between request completion and timeout handling Greg Kroah-Hartman
2013-11-27 0:57 ` Greg Kroah-Hartman [this message]
2013-11-27 0:57 ` [PATCH 3.10 64/80] block: properly stack underlying max_segment_size to DM device Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 65/80] powerpc/52xx: fix build breakage for MPC5200 LPBFIFO module Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 66/80] powerpc/vio: use strcpy in modalias_show Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 67/80] powerpc/powernv: Add PE to its own PELTV Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 68/80] powerpc: ppc64 address space capped at 32TB, mmap randomisation disabled Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 69/80] powerpc/signals: Mark VSX not saved with small contexts Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 70/80] slub: Handle NULL parameter in kmem_cache_flags Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 71/80] SUNRPC: Fix a data corruption issue when retransmitting RPC calls Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 72/80] mei: nfc: fix memory leak in error path Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 73/80] usb: hub: Clear Port Reset Change during init/resume Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 74/80] rt2800usb: slow down TX status polling Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 75/80] s390/vtime: correct idle time calculation Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 76/80] configfs: fix race between dentry put and lookup Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 77/80] cris: media platform drivers: fix build Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 78/80] dmi: add support for exact DMI matches in addition to substring matching Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 79/80] drm/i915: quirk away phantom LVDS on Intels D510MO mainboard Greg Kroah-Hartman
2013-11-27 0:57 ` [PATCH 3.10 80/80] drm/i915: No LVDS hardware on Intel D410PT and D425KT Greg Kroah-Hartman
2013-11-27 12:57 ` [PATCH 3.10 00/80] 3.10.21-stable review Guenter Roeck
2013-11-27 22:29 ` Shuah Khan
2013-11-28 10:55 ` Satoru Takeuchi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131127005645.313967908@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=axboe@kernel.dk \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatocka@redhat.com \
--cc=stable@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).