From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753729AbdHVTUc (ORCPT ); Tue, 22 Aug 2017 15:20:32 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:44582 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753474AbdHVTOt (ORCPT ); Tue, 22 Aug 2017 15:14:49 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Munehisa Kamata , Thomas Friebel , Eduardo Valentin , Boris Ostrovsky , Juergen Gross , Konrad Rzeszutek Wilk , Roger Pau Monne , xen-devel@lists.xenproject.org Subject: [PATCH 4.12 27/41] xen-blkfront: use a right index when checking requests Date: Tue, 22 Aug 2017 12:13:55 -0700 Message-Id: <20170822190943.024693871@linuxfoundation.org> X-Mailer: git-send-email 2.14.1 In-Reply-To: <20170822190941.918296529@linuxfoundation.org> References: <20170822190941.918296529@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Munehisa Kamata commit b15bd8cb37598afb2963f7eb9e2de468d2d60a2f upstream. Since commit d05d7f40791c ("Merge branch 'for-4.8/core' of git://git.kernel.dk/linux-block") and 3fc9d690936f ("Merge branch 'for-4.8/drivers' of git://git.kernel.dk/linux-block"), blkfront_resume() has been using an index for iterating ring_info to check request when iterating blk_shadow in an inner loop. This seems to have been accidentally introduced during the massive rewrite of the block layer macros in the commits. This may cause crash like this: [11798.057074] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 [11798.058832] IP: [] blkfront_resume+0x10a/0x610 .... [11798.061063] Call Trace: [11798.061063] [] xenbus_dev_resume+0x53/0x140 [11798.061063] [] ? xenbus_dev_probe+0x150/0x150 [11798.061063] [] dpm_run_callback+0x3e/0x110 [11798.061063] [] device_resume+0x88/0x190 [11798.061063] [] dpm_resume+0x100/0x2d0 [11798.061063] [] dpm_resume_end+0x11/0x20 [11798.061063] [] do_suspend+0xe8/0x1a0 [11798.061063] [] shutdown_handler+0xfd/0x130 [11798.061063] [] ? split+0x110/0x110 [11798.061063] [] xenwatch_thread+0x86/0x120 [11798.061063] [] ? prepare_to_wait_event+0x110/0x110 [11798.061063] [] kthread+0xd7/0xf0 [11798.061063] [] ? kfree+0x121/0x170 [11798.061063] [] ? kthread_park+0x60/0x60 [11798.061063] [] ? call_usermodehelper_exec_work+0xb0/0xb0 [11798.061063] [] ? call_usermodehelper_exec_async+0x13a/0x140 [11798.061063] [] ret_from_fork+0x25/0x30 Use the right index in the inner loop. Fixes: d05d7f40791c ("Merge branch 'for-4.8/core' of git://git.kernel.dk/linux-block") Fixes: 3fc9d690936f ("Merge branch 'for-4.8/drivers' of git://git.kernel.dk/linux-block") Signed-off-by: Munehisa Kamata Reviewed-by: Thomas Friebel Reviewed-by: Eduardo Valentin Reviewed-by: Boris Ostrovsky Cc: Juergen Gross Cc: Konrad Rzeszutek Wilk Reviewed-by: Roger Pau Monne Cc: xen-devel@lists.xenproject.org Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman --- drivers/block/xen-blkfront.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -2119,9 +2119,9 @@ static int blkfront_resume(struct xenbus /* * Get the bios in the request so we can re-queue them. */ - if (req_op(shadow[i].request) == REQ_OP_FLUSH || - req_op(shadow[i].request) == REQ_OP_DISCARD || - req_op(shadow[i].request) == REQ_OP_SECURE_ERASE || + if (req_op(shadow[j].request) == REQ_OP_FLUSH || + req_op(shadow[j].request) == REQ_OP_DISCARD || + req_op(shadow[j].request) == REQ_OP_SECURE_ERASE || shadow[j].request->cmd_flags & REQ_FUA) { /* * Flush operations don't contain bios, so From mboxrd@z Thu Jan 1 00:00:00 1970 From: Greg Kroah-Hartman Subject: [PATCH 4.12 27/41] xen-blkfront: use a right index when checking requests Date: Tue, 22 Aug 2017 12:13:55 -0700 Message-ID: <20170822190943.024693871@linuxfoundation.org> References: <20170822190941.918296529@linuxfoundation.org> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dkEdZ-0007kA-Tc for xen-devel@lists.xenproject.org; Tue, 22 Aug 2017 19:14:54 +0000 In-Reply-To: <20170822190941.918296529@linuxfoundation.org> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" To: linux-kernel@vger.kernel.org Cc: Juergen Gross , Eduardo Valentin , Thomas Friebel , Greg Kroah-Hartman , Munehisa Kamata , stable@vger.kernel.org, xen-devel@lists.xenproject.org, Boris Ostrovsky , Roger Pau Monne List-Id: xen-devel@lists.xenproject.org NC4xMi1zdGFibGUgcmV2aWV3IHBhdGNoLiAgSWYgYW55b25lIGhhcyBhbnkgb2JqZWN0aW9ucywg cGxlYXNlIGxldCBtZSBrbm93LgoKLS0tLS0tLS0tLS0tLS0tLS0tCgpGcm9tOiBNdW5laGlzYSBL YW1hdGEgPGthbWF0YW1AYW1hem9uLmNvbT4KCmNvbW1pdCBiMTViZDhjYjM3NTk4YWZiMjk2M2Y3 ZWI5ZTJkZTQ2OGQyZDYwYTJmIHVwc3RyZWFtLgoKU2luY2UgY29tbWl0IGQwNWQ3ZjQwNzkxYyAo Ik1lcmdlIGJyYW5jaCAnZm9yLTQuOC9jb3JlJyBvZgpnaXQ6Ly9naXQua2VybmVsLmRrL2xpbnV4 LWJsb2NrIikgYW5kIDNmYzlkNjkwOTM2ZiAoIk1lcmdlIGJyYW5jaAonZm9yLTQuOC9kcml2ZXJz JyBvZiBnaXQ6Ly9naXQua2VybmVsLmRrL2xpbnV4LWJsb2NrIiksIGJsa2Zyb250X3Jlc3VtZSgp CmhhcyBiZWVuIHVzaW5nIGFuIGluZGV4IGZvciBpdGVyYXRpbmcgcmluZ19pbmZvIHRvIGNoZWNr IHJlcXVlc3Qgd2hlbgppdGVyYXRpbmcgYmxrX3NoYWRvdyBpbiBhbiBpbm5lciBsb29wLiBUaGlz IHNlZW1zIHRvIGhhdmUgYmVlbgphY2NpZGVudGFsbHkgaW50cm9kdWNlZCBkdXJpbmcgdGhlIG1h c3NpdmUgcmV3cml0ZSBvZiB0aGUgYmxvY2sgbGF5ZXIKbWFjcm9zIGluIHRoZSBjb21taXRzLgoK VGhpcyBtYXkgY2F1c2UgY3Jhc2ggbGlrZSB0aGlzOgoKWzExNzk4LjA1NzA3NF0gQlVHOiB1bmFi bGUgdG8gaGFuZGxlIGtlcm5lbCBOVUxMIHBvaW50ZXIgZGVyZWZlcmVuY2UgYXQgMDAwMDAwMDAw MDAwMDA0OApbMTE3OTguMDU4ODMyXSBJUDogWzxmZmZmZmZmZjgxNDQxMWZhPl0gYmxrZnJvbnRf cmVzdW1lKzB4MTBhLzB4NjEwCi4uLi4KWzExNzk4LjA2MTA2M10gQ2FsbCBUcmFjZToKWzExNzk4 LjA2MTA2M10gIFs8ZmZmZmZmZmY4MTM5Y2U5Mz5dIHhlbmJ1c19kZXZfcmVzdW1lKzB4NTMvMHgx NDAKWzExNzk4LjA2MTA2M10gIFs8ZmZmZmZmZmY4MTM5Y2U0MD5dID8geGVuYnVzX2Rldl9wcm9i ZSsweDE1MC8weDE1MApbMTE3OTguMDYxMDYzXSAgWzxmZmZmZmZmZjgxM2YzNTllPl0gZHBtX3J1 bl9jYWxsYmFjaysweDNlLzB4MTEwClsxMTc5OC4wNjEwNjNdICBbPGZmZmZmZmZmODEzZjNhMDg+ XSBkZXZpY2VfcmVzdW1lKzB4ODgvMHgxOTAKWzExNzk4LjA2MTA2M10gIFs8ZmZmZmZmZmY4MTNm NGNjMD5dIGRwbV9yZXN1bWUrMHgxMDAvMHgyZDAKWzExNzk4LjA2MTA2M10gIFs8ZmZmZmZmZmY4 MTNmNTIyMT5dIGRwbV9yZXN1bWVfZW5kKzB4MTEvMHgyMApbMTE3OTguMDYxMDYzXSAgWzxmZmZm ZmZmZjgxMzk1MGE4Pl0gZG9fc3VzcGVuZCsweGU4LzB4MWEwClsxMTc5OC4wNjEwNjNdICBbPGZm ZmZmZmZmODEzOTU0YmQ+XSBzaHV0ZG93bl9oYW5kbGVyKzB4ZmQvMHgxMzAKWzExNzk4LjA2MTA2 M10gIFs8ZmZmZmZmZmY4MTM5YWJhMD5dID8gc3BsaXQrMHgxMTAvMHgxMTAKWzExNzk4LjA2MTA2 M10gIFs8ZmZmZmZmZmY4MTM5YWMyNj5dIHhlbndhdGNoX3RocmVhZCsweDg2LzB4MTIwClsxMTc5 OC4wNjEwNjNdICBbPGZmZmZmZmZmODEwYjQ1NzA+XSA/IHByZXBhcmVfdG9fd2FpdF9ldmVudCsw eDExMC8weDExMApbMTE3OTguMDYxMDYzXSAgWzxmZmZmZmZmZjgxMDhmZTU3Pl0ga3RocmVhZCsw eGQ3LzB4ZjAKWzExNzk4LjA2MTA2M10gIFs8ZmZmZmZmZmY4MTFkYTgxMT5dID8ga2ZyZWUrMHgx MjEvMHgxNzAKWzExNzk4LjA2MTA2M10gIFs8ZmZmZmZmZmY4MTA4ZmQ4MD5dID8ga3RocmVhZF9w YXJrKzB4NjAvMHg2MApbMTE3OTguMDYxMDYzXSAgWzxmZmZmZmZmZjgxMDg2M2IwPl0gPyAgY2Fs bF91c2VybW9kZWhlbHBlcl9leGVjX3dvcmsrMHhiMC8weGIwClsxMTc5OC4wNjEwNjNdICBbPGZm ZmZmZmZmODEwODY0ZWE+XSA/ICBjYWxsX3VzZXJtb2RlaGVscGVyX2V4ZWNfYXN5bmMrMHgxM2Ev MHgxNDAKWzExNzk4LjA2MTA2M10gIFs8ZmZmZmZmZmY4MTUzNGE0NT5dIHJldF9mcm9tX2Zvcmsr MHgyNS8weDMwCgpVc2UgdGhlIHJpZ2h0IGluZGV4IGluIHRoZSBpbm5lciBsb29wLgoKRml4ZXM6 IGQwNWQ3ZjQwNzkxYyAoIk1lcmdlIGJyYW5jaCAnZm9yLTQuOC9jb3JlJyBvZiBnaXQ6Ly9naXQu a2VybmVsLmRrL2xpbnV4LWJsb2NrIikKRml4ZXM6IDNmYzlkNjkwOTM2ZiAoIk1lcmdlIGJyYW5j aCAnZm9yLTQuOC9kcml2ZXJzJyBvZiBnaXQ6Ly9naXQua2VybmVsLmRrL2xpbnV4LWJsb2NrIikK U2lnbmVkLW9mZi1ieTogTXVuZWhpc2EgS2FtYXRhIDxrYW1hdGFtQGFtYXpvbi5jb20+ClJldmll d2VkLWJ5OiBUaG9tYXMgRnJpZWJlbCA8ZnJpZWJlbHRAYW1hem9uLmRlPgpSZXZpZXdlZC1ieTog RWR1YXJkbyBWYWxlbnRpbiA8ZWR1dmFsQGFtYXpvbi5jb20+ClJldmlld2VkLWJ5OiBCb3JpcyBP c3Ryb3Zza3kgPGJvcmlzLm9zdHJvdnNreUBvcmFjbGUuY29tPgpDYzogSnVlcmdlbiBHcm9zcyA8 amdyb3NzQHN1c2UuY29tPgpDYzogS29ucmFkIFJ6ZXN6dXRlayBXaWxrIDxrb25yYWQud2lsa0Bv cmFjbGUuY29tPgpSZXZpZXdlZC1ieTogUm9nZXIgUGF1IE1vbm5lIDxyb2dlci5wYXVAY2l0cml4 LmNvbT4KQ2M6IHhlbi1kZXZlbEBsaXN0cy54ZW5wcm9qZWN0Lm9yZwpTaWduZWQtb2ZmLWJ5OiBL b25yYWQgUnplc3p1dGVrIFdpbGsgPGtvbnJhZC53aWxrQG9yYWNsZS5jb20+ClNpZ25lZC1vZmYt Ynk6IEdyZWcgS3JvYWgtSGFydG1hbiA8Z3JlZ2toQGxpbnV4Zm91bmRhdGlvbi5vcmc+CgotLS0K IGRyaXZlcnMvYmxvY2sveGVuLWJsa2Zyb250LmMgfCAgICA2ICsrKy0tLQogMSBmaWxlIGNoYW5n ZWQsIDMgaW5zZXJ0aW9ucygrKSwgMyBkZWxldGlvbnMoLSkKCi0tLSBhL2RyaXZlcnMvYmxvY2sv eGVuLWJsa2Zyb250LmMKKysrIGIvZHJpdmVycy9ibG9jay94ZW4tYmxrZnJvbnQuYwpAQCAtMjEx OSw5ICsyMTE5LDkgQEAgc3RhdGljIGludCBibGtmcm9udF9yZXN1bWUoc3RydWN0IHhlbmJ1cwog CQkJLyoKIAkJCSAqIEdldCB0aGUgYmlvcyBpbiB0aGUgcmVxdWVzdCBzbyB3ZSBjYW4gcmUtcXVl dWUgdGhlbS4KIAkJCSAqLwotCQkJaWYgKHJlcV9vcChzaGFkb3dbaV0ucmVxdWVzdCkgPT0gUkVR X09QX0ZMVVNIIHx8Ci0JCQkgICAgcmVxX29wKHNoYWRvd1tpXS5yZXF1ZXN0KSA9PSBSRVFfT1Bf RElTQ0FSRCB8fAotCQkJICAgIHJlcV9vcChzaGFkb3dbaV0ucmVxdWVzdCkgPT0gUkVRX09QX1NF Q1VSRV9FUkFTRSB8fAorCQkJaWYgKHJlcV9vcChzaGFkb3dbal0ucmVxdWVzdCkgPT0gUkVRX09Q X0ZMVVNIIHx8CisJCQkgICAgcmVxX29wKHNoYWRvd1tqXS5yZXF1ZXN0KSA9PSBSRVFfT1BfRElT Q0FSRCB8fAorCQkJICAgIHJlcV9vcChzaGFkb3dbal0ucmVxdWVzdCkgPT0gUkVRX09QX1NFQ1VS RV9FUkFTRSB8fAogCQkJICAgIHNoYWRvd1tqXS5yZXF1ZXN0LT5jbWRfZmxhZ3MgJiBSRVFfRlVB KSB7CiAJCQkJLyoKIAkJCQkgKiBGbHVzaCBvcGVyYXRpb25zIGRvbid0IGNvbnRhaW4gYmlvcywg c28KCgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KWGVu LWRldmVsIG1haWxpbmcgbGlzdApYZW4tZGV2ZWxAbGlzdHMueGVuLm9yZwpodHRwczovL2xpc3Rz Lnhlbi5vcmcveGVuLWRldmVsCg==