* [PATCH] block: fix potential dereference null pointer
@ 2022-04-01 8:36 cgel.zte
2022-04-01 12:31 ` Philipp Reisner
0 siblings, 1 reply; 2+ messages in thread
From: cgel.zte @ 2022-04-01 8:36 UTC (permalink / raw)
To: philipp.reisner
Cc: lars.ellenberg, christoph.boehmwalder, axboe, drbd-dev,
linux-block, linux-kernel, Lv Ruyi, Zeal Robot
From: Lv Ruyi <lv.ruyi@zte.com.cn>
rcu_dereference may return NULL, so check the returned pointer.
Reported-by: Zeal Robot <zealci@zte.com.cn>
Signed-off-by: Lv Ruyi <lv.ruyi@zte.com.cn>
---
drivers/block/drbd/drbd_req.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index e1e58e91ee58..8ab6da155e2f 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -577,6 +577,10 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
D_ASSERT(device, !(req->rq_state & RQ_NET_MASK));
rcu_read_lock();
nc = rcu_dereference(connection->net_conf);
+ if (!nc) {
+ rcu_read_unlock();
+ break;
+ }
p = nc->wire_protocol;
rcu_read_unlock();
req->rq_state |=
@@ -690,6 +694,10 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
/* close the epoch, in case it outgrew the limit */
rcu_read_lock();
nc = rcu_dereference(connection->net_conf);
+ if (!nc) {
+ rcu_read_unlock();
+ break;
+ }
p = nc->max_epoch_size;
rcu_read_unlock();
if (connection->current_tle_writes >= p)
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] block: fix potential dereference null pointer
2022-04-01 8:36 [PATCH] block: fix potential dereference null pointer cgel.zte
@ 2022-04-01 12:31 ` Philipp Reisner
0 siblings, 0 replies; 2+ messages in thread
From: Philipp Reisner @ 2022-04-01 12:31 UTC (permalink / raw)
To: cgel.zte
Cc: Lars Ellenberg, Christoph Böhmwalder, Jens Axboe, drbd-dev,
linux-block, linux-kernel, Lv Ruyi, Zeal Robot
Hi Lv Ruyi,
This patch does not make sense to me. A request can only get "TO_BE_SENT"
when the connection is established with the corresponding
cstate. Establishing a connection can only work if net_conf is set. net_conf
can be exchanged to a new one, but never become NULL.
Please share more details why you think this NULL check is necessary here?
On Fri, Apr 1, 2022 at 10:36 AM <cgel.zte@gmail.com> wrote:
>
> From: Lv Ruyi <lv.ruyi@zte.com.cn>
>
> rcu_dereference may return NULL, so check the returned pointer.
>
> Reported-by: Zeal Robot <zealci@zte.com.cn>
> Signed-off-by: Lv Ruyi <lv.ruyi@zte.com.cn>
> ---
> drivers/block/drbd/drbd_req.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
> index e1e58e91ee58..8ab6da155e2f 100644
> --- a/drivers/block/drbd/drbd_req.c
> +++ b/drivers/block/drbd/drbd_req.c
> @@ -577,6 +577,10 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
> D_ASSERT(device, !(req->rq_state & RQ_NET_MASK));
> rcu_read_lock();
> nc = rcu_dereference(connection->net_conf);
> + if (!nc) {
> + rcu_read_unlock();
> + break;
> + }
> p = nc->wire_protocol;
> rcu_read_unlock();
> req->rq_state |=
> @@ -690,6 +694,10 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
> /* close the epoch, in case it outgrew the limit */
> rcu_read_lock();
> nc = rcu_dereference(connection->net_conf);
> + if (!nc) {
> + rcu_read_unlock();
> + break;
> + }
> p = nc->max_epoch_size;
> rcu_read_unlock();
> if (connection->current_tle_writes >= p)
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-04-01 12:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-01 8:36 [PATCH] block: fix potential dereference null pointer cgel.zte
2022-04-01 12:31 ` Philipp Reisner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).