From: Johannes Weiner <hannes-kernel@saeurebad.de>
To: Jens Axboe <jens.axboe@oracle.com>
Cc: linux-kernel@vger.kernel.org
Subject: Re: PROBLEM: null pointer dereference in cfq_dispatch_requests (2.6.21-rc2 and 2.6.20)
Date: Thu, 22 Mar 2007 20:22:34 +0100 [thread overview]
Message-ID: <20070322192233.GA5873@localhost> (raw)
In-Reply-To: <20070322184235.GZ19922@kernel.dk>
Hi,
On Thu, Mar 22, 2007 at 07:42:35PM +0100, Jens Axboe wrote:
> > diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
> > index b6491c0..ca84f0b 100644
> > --- a/block/cfq-iosched.c
> > +++ b/block/cfq-iosched.c
> > @@ -961,8 +961,8 @@ __cfq_dispatch_requests(struct cfq_data *cfqd, struct cfq_queue *cfqq,
> > /*
> > * follow expired path, else get first next available
> > */
> > - if ((rq = cfq_check_fifo(cfqq)) == NULL)
> > - rq = cfqq->next_rq;
> > + if (!(rq = cfq_check_fifo(cfqq)) && !(rq = cfqq->next_rq))
> > + break;
>
> That still only hides a bug. It is illegal for ->next_rq to be NULL
> while the RB tree is non-empty.
As I noticed afterwards this isn't even the point where the NULL ptr is
dereferenced. It must be in the next code-line, cfqd->queue or
cfqd->queue->elevator was NULL when the oops occured or am I wrong?
'Hannes
prev parent reply other threads:[~2007-03-22 19:23 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-02-28 18:02 PROBLEM: null pointer dereference in cfq_dispatch_requests (2.6.21-rc2 and 2.6.20) Dan Williams
2007-02-28 18:18 ` Dan Williams
2007-02-28 18:49 ` Chuck Ebbert
2007-02-28 19:21 ` Chuck Ebbert
2007-03-01 12:08 ` Frank Seidel
2007-03-01 12:30 ` Jens Axboe
2007-03-01 19:50 ` Dan Williams
2007-03-21 13:07 ` Dale Blount
2007-03-21 18:09 ` Chuck Ebbert
2007-03-21 18:23 ` Dale Blount
2007-03-21 18:25 ` Chuck Ebbert
2007-03-21 19:59 ` Jens Axboe
2007-03-22 12:54 ` Dale Blount
2007-03-21 19:04 ` Johannes Weiner
2007-03-22 17:29 ` Johannes Weiner
2007-03-22 18:42 ` Jens Axboe
2007-03-22 19:22 ` Johannes Weiner [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20070322192233.GA5873@localhost \
--to=hannes-kernel@saeurebad.de \
--cc=jens.axboe@oracle.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.