In detached_dev_do_request(), the return value of kzalloc() is
assigned to ddip, and there is a dereference of it in
detached_dev_do_request(), which could lead to a NULL pointer
dereference on failure of kzalloc().
Fix this bug by adding a check of ddip. This patch imitates the
failure-handling logic in cached_dev_submit_bio().
Note that we found the fixing of the bug hard, as the return value of
the callers is void and we cannot pass an error status upstream.
Please adivce if there is a better way for fixing.
This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it might be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.
Builds with CONFIG_BCACHE=m show no new warnings, and our static
analyzer no longer warns about this code.
Fixes: bc082a55d25c ("bcache: fix inaccurate io state for detached bcache devices")
Signed-off-by: Zhou Qingyang <zhou1615@xxxxxxx>
---
drivers/md/bcache/request.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index d15aae6c51c1..3a17925c734b 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -1107,6 +1107,11 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
* which would call closure_get(&dc->disk.cl)
*/
ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO);
+ if (!ddip) {
+ bio->bi_status = BLK_STS_RESOURCE;
+ bio_endio(bio);
+ return;
+ }
ddip->d = d;
/* Count on the bcache device */
ddip->orig_bdev = orig_bdev;
--
2.25.1
