Re: [RFC PATCH] fs null_blk: Null pointer deference problem in alloc_page_buffers

[Matias Bjorling <m@bjorling.me>]

On 01/17/2014 01:22 AM, Raghavendra K T wrote:
>
> diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
> index a2e69d2..6b0e049 100644
> --- a/drivers/block/null_blk.c
> +++ b/drivers/block/null_blk.c
> @@ -535,6 +535,11 @@ static int null_add_dev(void)
>   	if (!nullb)
>   		return -ENOMEM;
>
> +	if (bs > PAGE_SIZE) {
> +		WARN(1, "Invalid block size. Setting it to 4096\n");
> +		bs = 4096;
> +	}
> +

Use PAGESIZE instead, move it to null_init with the other checks and use 
pr_warn for issuing the warning.

>   	spin_lock_init(&nullb->lock);
>
>   	if (queue_mode == NULL_Q_MQ && use_per_node_hctx)
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 6024877..029c698 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -883,6 +883,7 @@ struct buffer_head *alloc_page_buffers(struct page *page, unsigned long size,
>   	struct buffer_head *bh, *head;
>   	long offset;
>
> +	BUG_ON(size > PAGE_SIZE);
>   try_again:
>   	head = NULL;
>   	offset = PAGE_SIZE;
> @@ -1571,6 +1572,7 @@ void create_empty_buffers(struct page *page,
>   	struct buffer_head *bh, *head, *tail;
>
>   	head = alloc_page_buffers(page, blocksize, 1);
> +	BUG_ON(!head);
>   	bh = head;
>   	do {
>   		bh->b_state |= b_state;
>

It seems? that the physical sector size is always limited to the system 
page size.

Why not do the check in add_disk (or __blkdev_get) and fail there, 
instead of failing on the first partition check?