Re: [PATCH] mmc: fix null pointer use in mmc_blk_remove_req

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 25/08/13 06:22, Chris Ball wrote:
> Hi Franck,
> 
> On Wed, Jul 24 2013, franck.jullien@xxxxxxxxx wrote:
>> From: Franck Jullien <franck.jullien@xxxxxxxxx>
>>
>> A previous commit (fdfa20c1631210d0) reordered the
>> shutdown sequence in mmc_blk_remove_req. However,
>> mmc_cleanup_queue is now called before we get the
>> card pointer and, sadly, mmc_cleanup_queue set
>> mq->card to NULL.
>>
>> This patch moves the card pointer assignment before
>> mmc_cleanup_queue.
>>
>> Signed-off-by: Franck Jullien <franck.jullien@xxxxxxxxx>
>> ---
>>  drivers/mmc/card/block.c |    2 +-
>>  1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
>> index cd0b7f4..f4a0bea 100644
>> --- a/drivers/mmc/card/block.c
>> +++ b/drivers/mmc/card/block.c
>> @@ -2191,10 +2191,10 @@ static void mmc_blk_remove_req(struct mmc_blk_data *md)
>>  		 * is freeing the queue that stops new requests
>>  		 * from being accepted.
>>  		 */
>> +		card = md->queue.card;
>>  		mmc_cleanup_queue(&md->queue);
>>  		if (md->flags & MMC_BLK_PACKED_CMD)
>>  			mmc_packed_clean(&md->queue);
>> -		card = md->queue.card;
>>  		if (md->disk->flags & GENHD_FL_UP) {
>>  			device_remove_file(disk_to_dev(md->disk), &md->force_ro);
>>  			if ((md->area_type & MMC_BLK_DATA_AREA_BOOT) &&
> 
> Thanks for the patch, pushed to mmc-next for 3.12.

Hi

The regression is in 3.11, and causes an oops (see below)
Adding linux-stable

The fix is now in linus' tree with commit id:

	8efb83a2f8518a6ffcc074177f8d659c5165ef37

Please cherry-pick this for 3.11


[  107.814928] BUG: unable to handle kernel NULL pointer dereference at 0000000000000398
[  107.823706] IP: [<ffffffffa000d201>] mmc_blk_remove_req+0x56/0x8b [mmc_block]
[  107.831709] PGD 134323067 PUD 1343c2067 PMD 0 
[  107.836703] Oops: 0000 [#1] PREEMPT SMP 
[  107.841098] Modules linked in: sdhci_acpi(-) mmc_block sdhci
[  107.847468] CPU: 1 PID: 133 Comm: rmmod Not tainted 3.11.3+ #15
[  107.854090] task: ffff8801341dc440 ti: ffff88013426c000 task.ti: ffff88013426c000
[  107.862456] RIP: 0010:[<ffffffffa000d201>]  [<ffffffffa000d201>] mmc_blk_remove_req+0x56/0x8b [mmc_block]
[  107.873172] RSP: 0018:ffff88013426dbe8  EFLAGS: 00010202
[  107.879111] RAX: ffff8801341e63a8 RBX: ffff8801341e6000 RCX: 00000000000160a0
[  107.887088] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000023
[  107.895058] RBP: ffff88013426dbf8 R08: ffff88013b443180 R09: ffff88013426dfd8
[  107.903035] R10: 000000000000273c R11: ffff880134330e00 R12: 0000000000000000
[  107.911005] R13: ffff8801341e5000 R14: ffffffffa001c098 R15: 0000000000000000
[  107.918985] FS:  00007f9bab888700(0000) GS:ffff88013fc80000(0000) knlGS:0000000000000000
[  107.928031] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  107.934455] CR2: 0000000000000398 CR3: 0000000134263000 CR4: 00000000001007e0
[  107.942422] Stack:
[  107.944669]  ffff8801341e5ba8 ffff8801341e53a8 ffff88013426dc18 ffffffffa000dbfa
[  107.952965]  ffff8801341e4800 ffff8801341e4808 ffff88013426dc48 ffffffffa000fca0
[  107.961260]  000000000000bbc9 ffff8801341e4808 ffffffffa0012010 ffffffff81a82210
[  107.969556] Call Trace:
[  107.972307]  [<ffffffffa000dbfa>] mmc_blk_remove_parts.isra.16+0x5c/0x6c [mmc_block]
[  107.980980]  [<ffffffffa000fca0>] mmc_blk_remove+0x25/0xa9 [mmc_block]
[  107.988289]  [<ffffffff8140dd6c>] mmc_bus_remove+0x15/0x19
[  107.994432]  [<ffffffff812f14a8>] __device_release_driver+0x86/0xdc
[  108.001448]  [<ffffffff812f175d>] device_release_driver+0x1e/0x2b
[  108.008269]  [<ffffffff812f10bc>] bus_remove_device+0xe5/0xfa
[  108.014701]  [<ffffffff812eeb96>] device_del+0x12c/0x186
[  108.020646]  [<ffffffff8140e2cc>] mmc_remove_card+0x66/0x76
[  108.026884]  [<ffffffff8140ec55>] mmc_remove+0x23/0x32
[  108.032636]  [<ffffffff8140dbb2>] mmc_stop_host+0x58/0x9f
[  108.038678]  [<ffffffff8140e301>] mmc_remove_host+0x1d/0x3e
[  108.044923]  [<ffffffffa0001d76>] sdhci_remove_host+0x94/0x122 [sdhci]
[  108.052235]  [<ffffffffa001a145>] sdhci_acpi_remove+0x79/0x8b [sdhci_acpi]
[  108.059932]  [<ffffffff812f2e50>] platform_drv_remove+0x1a/0x3e
[  108.066559]  [<ffffffff812f14a8>] __device_release_driver+0x86/0xdc
[  108.073574]  [<ffffffff812f1c9f>] driver_detach+0x81/0xb2
[  108.079611]  [<ffffffff812f1357>] bus_remove_driver+0x6f/0xb4
[  108.086045]  [<ffffffffa001a568>] ? sdhci_acpi_probe+0x411/0x411 [sdhci_acpi]
[  108.094031]  [<ffffffff812f20a3>] driver_unregister+0x4e/0x73
[  108.100464]  [<ffffffff812f2d26>] platform_driver_unregister+0xd/0xf
[  108.107578]  [<ffffffffa001a578>] sdhci_acpi_driver_exit+0x10/0xa98 [sdhci_acpi]
[  108.115859]  [<ffffffff8107eac3>] SyS_delete_module+0x1b6/0x244
[  108.122488]  [<ffffffff8102c638>] ? do_page_fault+0x9/0xd
[  108.128535]  [<ffffffff815cd052>] system_call_fastpath+0x16/0x1b
[  108.135250] Code: 00 48 8b 7b 08 4c 8b 63 10 f6 87 60 03 00 00 10 74 41 48 8d b3 d8 03 00 00 48 83 c7 70 e8 26 10 2e e1 f6 83 18 04 00 00 02 74 1f <41> 80 bc 24 98 03 00 00 00 74 14 48 8b 7b 08 48 8d b3 f8 03 00 
[  108.156804] RIP  [<ffffffffa000d201>] mmc_blk_remove_req+0x56/0x8b [mmc_block]
[  108.164895]  RSP <ffff88013426dbe8>
[  108.168794] CR2: 0000000000000398
[  108.174595] ---[ end trace b9c7313fc09b25d8 ]---

--
To unsubscribe from this list: send the line "unsubscribe linux-mmc" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux USB Devel]     [Linux Media]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux