linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] mm/memcg: return value of the function mem_cgroup_from_css() is not checked
@ 2019-08-22  6:22 Yizhuo
  2019-08-22  7:05 ` Michal Hocko
  0 siblings, 1 reply; 4+ messages in thread
From: Yizhuo @ 2019-08-22  6:22 UTC (permalink / raw)
  Cc: csong, zhiyunq, Yizhuo, Johannes Weiner, Michal Hocko,
	Vladimir Davydov, cgroups, linux-mm, linux-kernel

Inside function mem_cgroup_wb_domain(), the pointer memcg
could be NULL via mem_cgroup_from_css(). However, this pointer is
not checked and directly dereferenced in the if statement,
which is potentially unsafe.

Signed-off-by: Yizhuo <yzhai003@ucr.edu>
---
 mm/memcontrol.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 661f046ad318..bd84bdaed3b0 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3665,7 +3665,7 @@ struct wb_domain *mem_cgroup_wb_domain(struct bdi_writeback *wb)
 {
 	struct mem_cgroup *memcg = mem_cgroup_from_css(wb->memcg_css);
 
-	if (!memcg->css.parent)
+	if (!memcg || !memcg->css.parent)
 		return NULL;
 
 	return &memcg->cgwb_domain;
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [PATCH] mm/memcg: return value of the function mem_cgroup_from_css() is not checked
  2019-08-22  6:22 [PATCH] mm/memcg: return value of the function mem_cgroup_from_css() is not checked Yizhuo
@ 2019-08-22  7:05 ` Michal Hocko
       [not found]   ` <CABvMjLRCt4gC3GKzBehGppxfyMOb6OGQwW-6Yu_+MbMp5tN3tg@mail.gmail.com>
  0 siblings, 1 reply; 4+ messages in thread
From: Michal Hocko @ 2019-08-22  7:05 UTC (permalink / raw)
  To: Yizhuo
  Cc: csong, zhiyunq, Johannes Weiner, Vladimir Davydov, cgroups,
	linux-mm, linux-kernel

On Wed 21-08-19 23:22:09, Yizhuo wrote:
> Inside function mem_cgroup_wb_domain(), the pointer memcg
> could be NULL via mem_cgroup_from_css(). However, this pointer is
> not checked and directly dereferenced in the if statement,
> which is potentially unsafe.

Could you describe circumstances when this would happen? The code is
this way for 5 years without any issues. Are we just lucky or something
has changed recently to make this happen?
 
> Signed-off-by: Yizhuo <yzhai003@ucr.edu>
> ---
>  mm/memcontrol.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
> index 661f046ad318..bd84bdaed3b0 100644
> --- a/mm/memcontrol.c
> +++ b/mm/memcontrol.c
> @@ -3665,7 +3665,7 @@ struct wb_domain *mem_cgroup_wb_domain(struct bdi_writeback *wb)
>  {
>  	struct mem_cgroup *memcg = mem_cgroup_from_css(wb->memcg_css);
>  
> -	if (!memcg->css.parent)
> +	if (!memcg || !memcg->css.parent)
>  		return NULL;
>  
>  	return &memcg->cgwb_domain;
> -- 
> 2.17.1
> 

-- 
Michal Hocko
SUSE Labs

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] mm/memcg: return value of the function mem_cgroup_from_css() is not checked
       [not found]   ` <CABvMjLRCt4gC3GKzBehGppxfyMOb6OGQwW-6Yu_+MbMp5tN3tg@mail.gmail.com>
@ 2019-08-22 20:12     ` Michal Hocko
  2019-08-30 22:27       ` Yizhuo Zhai
  0 siblings, 1 reply; 4+ messages in thread
From: Michal Hocko @ 2019-08-22 20:12 UTC (permalink / raw)
  To: Yizhuo Zhai
  Cc: Chengyu Song, Zhiyun Qian, Johannes Weiner, Vladimir Davydov,
	cgroups, linux-mm, linux-kernel

On Thu 22-08-19 13:07:17, Yizhuo Zhai wrote:
> This will happen if variable "wb->memcg_css" is NULL. This case is reported
> by our analysis tool.

Does your tool report the particular call path and conditions when that
happen? Or is it just a "it mignt happen" kinda thing?

> Since the function mem_cgroup_wb_domain() is visible to the global, we
> cannot control caller's behavior.

I am sorry but I do not understand what is this supposed to mean.
-- 
Michal Hocko
SUSE Labs

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] mm/memcg: return value of the function mem_cgroup_from_css() is not checked
  2019-08-22 20:12     ` Michal Hocko
@ 2019-08-30 22:27       ` Yizhuo Zhai
  0 siblings, 0 replies; 4+ messages in thread
From: Yizhuo Zhai @ 2019-08-30 22:27 UTC (permalink / raw)
  To: Michal Hocko
  Cc: Chengyu Song, Zhiyun Qian, Johannes Weiner, Vladimir Davydov,
	cgroups, linux-mm, linux-kernel

Our tool did not trace back the whole path, so, now we could say it
might happen.

On Thu, Aug 22, 2019 at 1:12 PM Michal Hocko <mhocko@kernel.org> wrote:
>
> On Thu 22-08-19 13:07:17, Yizhuo Zhai wrote:
> > This will happen if variable "wb->memcg_css" is NULL. This case is reported
> > by our analysis tool.
>
> Does your tool report the particular call path and conditions when that
> happen? Or is it just a "it mignt happen" kinda thing?
>
> > Since the function mem_cgroup_wb_domain() is visible to the global, we
> > cannot control caller's behavior.
>
> I am sorry but I do not understand what is this supposed to mean.
> --
> Michal Hocko
> SUSE Labs



-- 
Kind Regards,

Yizhuo Zhai

Computer Science, Graduate Student
University of California, Riverside

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2019-08-30 22:27 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-22  6:22 [PATCH] mm/memcg: return value of the function mem_cgroup_from_css() is not checked Yizhuo
2019-08-22  7:05 ` Michal Hocko
     [not found]   ` <CABvMjLRCt4gC3GKzBehGppxfyMOb6OGQwW-6Yu_+MbMp5tN3tg@mail.gmail.com>
2019-08-22 20:12     ` Michal Hocko
2019-08-30 22:27       ` Yizhuo Zhai

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).