Re: NULL pointer dereference in swsusp_free with 3.17-rc5

["Bjørn Mork" <bjorn@mork.no>]

Joerg Roedel <jroedel@suse.de> writes:

>> @@ -1343,7 +1343,15 @@ void swsusp_free(void)
>>  {
>>         unsigned long fb_pfn, fr_pfn;
>>  
>> +WARN_ON(!forbidden_pages_map);
>> +if (!forbidden_pages_map)
>> +       return;
>> +
>>         memory_bm_position_reset(forbidden_pages_map);
>> +WARN_ON(!free_pages_map);
>> +if (!free_pages_map)
>> +       return;
>> +
>>         memory_bm_position_reset(free_pages_map);
>
> ... the old code did not check for a valid forbidden_pages_map and
> free_pages_map either, so it should crash there too.

Well, it did test AFAICS...  The 3.16 code is

int swsusp_page_is_forbidden(struct page *page)
{
        return forbidden_pages_map ?
                memory_bm_test_bit(forbidden_pages_map, page_to_pfn(page)) : 0;
}

..

void swsusp_free(void)
{
..
                                if (swsusp_page_is_forbidden(page) &&
                                    swsusp_page_is_free(page)) {
                                        swsusp_unset_page_forbidden(page);
                                        swsusp_unset_page_free(page);
                                        __free_page(page);
                                }






Bjørn