* [PATCH] cfq: fix NULL pointer dereference in cfq_choose_cfqg.
@ 2012-03-04 12:10 Namjae Jeon
2012-03-04 12:29 ` richard -rw- weinberger
0 siblings, 1 reply; 3+ messages in thread
From: Namjae Jeon @ 2012-03-04 12:10 UTC (permalink / raw)
To: axboe, tj; +Cc: linux-kernel, Namjae Jeon
I found null pointer dereferencing possibility while reviewing.
If cfq_get_next_cfqg return null by RB_EMPTY_ROOT, null pointer dereferencing error can occur.
Signed-off-by: Namjae Jeon <linkinjeon@gmail.com>
---
block/cfq-iosched.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index d0ba505..d924272 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -2306,7 +2306,7 @@ static void cfq_choose_cfqg(struct cfq_data *cfqd)
cfqd->serving_group = cfqg;
/* Restore the workload type data */
- if (cfqg->saved_workload_slice) {
+ if (!cfqg && cfqg->saved_workload_slice) {
cfqd->workload_expires = jiffies + cfqg->saved_workload_slice;
cfqd->serving_type = cfqg->saved_workload;
cfqd->serving_prio = cfqg->saved_serving_prio;
--
1.7.5.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] cfq: fix NULL pointer dereference in cfq_choose_cfqg.
2012-03-04 12:10 [PATCH] cfq: fix NULL pointer dereference in cfq_choose_cfqg Namjae Jeon
@ 2012-03-04 12:29 ` richard -rw- weinberger
2012-03-05 5:17 ` Namjae Jeon
0 siblings, 1 reply; 3+ messages in thread
From: richard -rw- weinberger @ 2012-03-04 12:29 UTC (permalink / raw)
To: Namjae Jeon; +Cc: axboe, tj, linux-kernel
On Sun, Mar 4, 2012 at 1:10 PM, Namjae Jeon <linkinjeon@gmail.com> wrote:
> I found null pointer dereferencing possibility while reviewing.
> If cfq_get_next_cfqg return null by RB_EMPTY_ROOT, null pointer dereferencing error can occur.
>
> Signed-off-by: Namjae Jeon <linkinjeon@gmail.com>
> ---
> block/cfq-iosched.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
> index d0ba505..d924272 100644
> --- a/block/cfq-iosched.c
> +++ b/block/cfq-iosched.c
> @@ -2306,7 +2306,7 @@ static void cfq_choose_cfqg(struct cfq_data *cfqd)
> cfqd->serving_group = cfqg;
>
> /* Restore the workload type data */
> - if (cfqg->saved_workload_slice) {
> + if (!cfqg && cfqg->saved_workload_slice) {
> cfqd->workload_expires = jiffies + cfqg->saved_workload_slice;
> cfqd->serving_type = cfqg->saved_workload;
> cfqd->serving_prio = cfqg->saved_serving_prio;
I don't think that this is a correct fix.
1. Can it really happen that cfq_get_next_cfqg() returns NULL at this point?
2. Adding a if(!cfgg ...) does not solve the problem, it ignores it.
After the if block we call choose_service_tree().
I'm sure choose_service_tree() it not happy when we pass a NULL pointer to it...
--
Thanks,
//richard
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] cfq: fix NULL pointer dereference in cfq_choose_cfqg.
2012-03-04 12:29 ` richard -rw- weinberger
@ 2012-03-05 5:17 ` Namjae Jeon
0 siblings, 0 replies; 3+ messages in thread
From: Namjae Jeon @ 2012-03-05 5:17 UTC (permalink / raw)
To: richard -rw- weinberger; +Cc: axboe, tj, linux-kernel
Hi. Richard.
You're right. need to add exception code more. I will look for more.
Thanks.
2012/3/4 richard -rw- weinberger <richard.weinberger@gmail.com>:
> On Sun, Mar 4, 2012 at 1:10 PM, Namjae Jeon <linkinjeon@gmail.com> wrote:
>> I found null pointer dereferencing possibility while reviewing.
>> If cfq_get_next_cfqg return null by RB_EMPTY_ROOT, null pointer dereferencing error can occur.
>>
>> Signed-off-by: Namjae Jeon <linkinjeon@gmail.com>
>> ---
>> block/cfq-iosched.c | 2 +-
>> 1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
>> index d0ba505..d924272 100644
>> --- a/block/cfq-iosched.c
>> +++ b/block/cfq-iosched.c
>> @@ -2306,7 +2306,7 @@ static void cfq_choose_cfqg(struct cfq_data *cfqd)
>> cfqd->serving_group = cfqg;
>>
>> /* Restore the workload type data */
>> - if (cfqg->saved_workload_slice) {
>> + if (!cfqg && cfqg->saved_workload_slice) {
>> cfqd->workload_expires = jiffies + cfqg->saved_workload_slice;
>> cfqd->serving_type = cfqg->saved_workload;
>> cfqd->serving_prio = cfqg->saved_serving_prio;
>
> I don't think that this is a correct fix.
>
> 1. Can it really happen that cfq_get_next_cfqg() returns NULL at this point?
>
> 2. Adding a if(!cfgg ...) does not solve the problem, it ignores it.
> After the if block we call choose_service_tree().
> I'm sure choose_service_tree() it not happy when we pass a NULL pointer to it...
>
> --
> Thanks,
> //richard
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-03-05 5:17 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-03-04 12:10 [PATCH] cfq: fix NULL pointer dereference in cfq_choose_cfqg Namjae Jeon
2012-03-04 12:29 ` richard -rw- weinberger
2012-03-05 5:17 ` Namjae Jeon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).