Finally working on cachefs and found first bug

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



David,

I am finally working on cachefs and have hit my first bug:

About a quarter of the way into "cachefs_fill_super", a cachefs object is allocated (using "kmem_cache_alloc(cachefs_object_jar,...)") that will correspond to the root of the cachefs filesystem.  When "cachefs_object_jar" was created, its constructor was set to "cache_object_init_once()".  That routine calls "fscache_object_init()" to initialize the fscache object part of the cachefs object being constructed.

Here is the problem: The first thing "fscache_object_init()" does is an atomic inc of the object_count of the fscache_cache struct passed (by pointer) as the third argument of "fscache_object_init()".  :::BUT::: when "fscache_object_init()" is called from "cache_object_init_once()", the third argument is NULL, causing an "unable to handle kernel NULL pointer dereference" Oops.

I don't see that there is any valid fscache_cache struct here because the fscache_object is part of a cachefs_object and is not contained in a fscache_cache.  So my inclination is to modify "fscache_object_init()" to handle the case where it's fscache_cache argument is NULL.

Unless there is something in the fscache-api to handle a case like this.  I will look into that, but I thought I would check with you to make sure I was headed in the right direction.

What do you think?

-=# Paul Gilliam #=-


--
Linux-cachefs mailing list
Linux-cachefs@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/linux-cachefs


[Index of Archives]     [LARTC]     [Bugtraq]     [Yosemite Forum]
  Powered by Linux