Re: [PATCH] null_blk: Fix a NULL pointer dereference

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 9/23/21 11:53 AM, Jens Axboe wrote:
I think it's the assumption that poll_queueus == submit_queues. Does this
work for you?


diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index eb5cfe189e90..dac88c5daff9 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -1748,7 +1757,7 @@ static int setup_queues(struct nullb *nullb)
  	int nqueues = nr_cpu_ids;
if (g_poll_queues)
-		nqueues *= 2;
+		nqueues += g_poll_queues;
nullb->queues = kcalloc(nqueues, sizeof(struct nullb_queue),
  				GFP_KERNEL);
@@ -1814,7 +1823,7 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)
  						g_submit_queues;
  	poll_queues = nullb ? nullb->dev->poll_queues : g_poll_queues;
  	if (poll_queues)
-		set->nr_hw_queues *= 2;
+		set->nr_hw_queues += poll_queues;
  	set->queue_depth = nullb ? nullb->dev->hw_queue_depth :
  						g_hw_queue_depth;
  	set->numa_node = nullb ? nullb->dev->home_node : g_home_node;

Hi Jens,

That patch makes test block/020 pass but unfortunately is not sufficient to
make test block/029 pass. This is what is triggered by test block/029:

null_blk: module loaded
==================================================================
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0x2d2/0x820
Read of size 8 at addr 0000000000000128 by task check/6065

CPU: 11 PID: 6065 Comm: check Tainted: G            E     5.15.0-rc1-dbg+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
 show_stack+0x52/0x58
 dump_stack_lvl+0x49/0x5e
 kasan_report.cold+0x64/0xdb
 kasan_check_range+0x14f/0x1a0
 __kasan_check_read+0x11/0x20
 blk_mq_map_swqueue+0x2d2/0x820
 __blk_mq_update_nr_hw_queues+0x358/0x670
 blk_mq_update_nr_hw_queues+0x31/0x50
 nullb_device_submit_queues_store+0xc1/0x130 [null_blk]
 configfs_write_iter+0x18b/0x220
 new_sync_write+0x287/0x390
 vfs_write+0x442/0x590
 ksys_write+0xbd/0x150
 __x64_sys_write+0x42/0x50
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff43deb0367
Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
RSP: 002b:00007ffcabaa5df8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007ff43deb0367
RDX: 0000000000000002 RSI: 000055c2e105a510 RDI: 0000000000000001
RBP: 000055c2e105a510 R08: 000000000000000a R09: 00007ff43df464e0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ff43df83520 R14: 0000000000000002 R15: 00007ff43df83700
==================================================================






[Index of Archives]     [Linux RAID]     [Linux SCSI]     [Linux ATA RAID]     [IDE]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Device Mapper]

  Powered by Linux