From: Roger Pau Monne <roger.pau@citrix.com>
To: Jan Beulich <JBeulich@suse.com>
Cc: xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] xen-blkfront: avoid NULL de-reference in CDROM ioctl handling
Date: Thu, 7 Jul 2016 12:56:54 +0200 [thread overview]
Message-ID: <20160707105654.irp7h7uk5fttbgvb__31685.3502802134$1467889147$gmane$org@mac> (raw)
In-Reply-To: <577E400A02000078000FC0CB@prv-mh.provo.novell.com>
On Thu, Jul 07, 2016 at 03:42:02AM -0600, Jan Beulich wrote:
> >>> On 07.07.16 at 11:32, <roger.pau@citrix.com> wrote:
> > On Thu, Jul 07, 2016 at 01:40:54AM -0600, Jan Beulich wrote:
> >> The ioctl can be called prior to full device setup having completed.
> >>
> >> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> >> ---
> >> drivers/block/xen-blkfront.c | 6 ++----
> >> 1 file changed, 2 insertions(+), 4 deletions(-)
> >>
> >> --- 4.7-rc6-xen.orig/drivers/block/xen-blkfront.c
> >> +++ 4.7-rc6-xen/drivers/block/xen-blkfront.c
> >> @@ -496,12 +496,10 @@ static int blkif_ioctl(struct block_devi
> >> return -EFAULT;
> >> return 0;
> >>
> >> - case CDROM_GET_CAPABILITY: {
> >> - struct gendisk *gd = info->gd;
> >> - if (gd->flags & GENHD_FL_CD)
> >> + case CDROM_GET_CAPABILITY:
> >> + if (info->gd && (info->gd->flags & GENHD_FL_CD))
> >
> > I don't follow how blkif_ioctl can be called with a NULL info->gd, because
> > the set of file operations is set inside of info->gd->fops. And the disk
> > should not be available until add_disk is called, which happens after having
> > info->gd already set.
>
> Well, this (as many of the other patches sent earlier today) is a
> result of me finally doing a sweep over the old 2.6.18 tree to
> see which changes never made it upstream. This is one of them.
> Hence I can't entirely exclude that the issue cannot be observed
> on a modern kernel (for whatever reason), but it surely was
> observed years ago on that old kernel. The sequence of events
> in xlvbd_alloc_gendisk() alone certainly leaves room for this, but
> I agree that the call to add_disk() _should_ be a prereq to getting
> into blkif_ioctl() and definitely only happens after
> xlvbd_alloc_gendisk() completed. But I guess you agree that this
> _should_ should also have applied to 2.6.18.
I agree that it looks like 2.6.18 has the same flow, so that info->gd cannot
be NULL if the ioctl handler is called, but without anyone having reported
any issue and blkfront code being in upstream Linux for quite a long time
I'm reluctant to take this, even more without a trace that shows the actual
bug.
Roger.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
next prev parent reply other threads:[~2016-07-07 10:56 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <577E23A602000078000FBE15@prv-mh.provo.novell.com>
2016-07-07 9:32 ` [PATCH] xen-blkfront: avoid NULL de-reference in CDROM ioctl handling Roger Pau Monne
2016-07-07 9:42 ` Jan Beulich
2016-07-07 10:56 ` Roger Pau Monne [this message]
2016-07-07 7:40 Jan Beulich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='20160707105654.irp7h7uk5fttbgvb__31685.3502802134$1467889147$gmane$org@mac' \
--to=roger.pau@citrix.com \
--cc=JBeulich@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).