From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759870AbcDMHbU (ORCPT ); Wed, 13 Apr 2016 03:31:20 -0400 Received: from terminus.zytor.com ([198.137.202.10]:51478 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759848AbcDMHbR (ORCPT ); Wed, 13 Apr 2016 03:31:17 -0400 Date: Wed, 13 Apr 2016 00:30:32 -0700 From: tip-bot for Davidlohr Bueso Message-ID: Cc: paulmck@linux.vnet.ibm.com, akpm@linux-foundation.org, tglx@linutronix.de, dbueso@suse.de, mingo@kernel.org, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, dave@stgolabs.net, wangkefeng.wang@huawei.com, peterz@infradead.org, hpa@zytor.com Reply-To: peterz@infradead.org, hpa@zytor.com, wangkefeng.wang@huawei.com, dave@stgolabs.net, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, mingo@kernel.org, dbueso@suse.de, tglx@linutronix.de, paulmck@linux.vnet.ibm.com, akpm@linux-foundation.org In-Reply-To: <1460476038-27060-2-git-send-email-paulmck@linux.vnet.ibm.com> References: <1460476038-27060-2-git-send-email-paulmck@linux.vnet.ibm.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:locking/core] locking/locktorture: Fix NULL pointer dereference for cleanup paths Git-Commit-ID: c1c33b92db4fb274dfbff778ccf2459e4bebd48e X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: c1c33b92db4fb274dfbff778ccf2459e4bebd48e Gitweb: http://git.kernel.org/tip/c1c33b92db4fb274dfbff778ccf2459e4bebd48e Author: Davidlohr Bueso AuthorDate: Tue, 12 Apr 2016 08:47:18 -0700 Committer: Ingo Molnar CommitDate: Wed, 13 Apr 2016 08:52:23 +0200 locking/locktorture: Fix NULL pointer dereference for cleanup paths It has been found that paths that invoke cleanups through lock_torture_cleanup() can trigger NULL pointer dereferencing bugs during the statistics printing phase. This is mainly because we should not be calling into statistics before we are sure things have been set up correctly. Specifically, early checks (and the need for handling this in the cleanup call) only include parameter checks and basic statistics allocation. Once we start write/read kthreads we then consider the test as started. As such, update the function in question to check for cxt.lwsa writer stats, if not set, we either have a bogus parameter or -ENOMEM situation and therefore only need to deal with general torture calls. Reported-and-tested-by: Kefeng Wang Signed-off-by: Davidlohr Bueso Signed-off-by: Paul E. McKenney Cc: Andrew Morton Cc: Davidlohr Bueso Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: bobby.prani@gmail.com Cc: dhowells@redhat.com Cc: dipankar@in.ibm.com Cc: dvhart@linux.intel.com Cc: edumazet@google.com Cc: fweisbec@gmail.com Cc: jiangshanlai@gmail.com Cc: josh@joshtriplett.org Cc: mathieu.desnoyers@efficios.com Cc: oleg@redhat.com Cc: rostedt@goodmis.org Link: http://lkml.kernel.org/r/1460476038-27060-2-git-send-email-paulmck@linux.vnet.ibm.com [ Improved the changelog. ] Signed-off-by: Ingo Molnar --- kernel/locking/locktorture.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c index 9e9c5f4..d066a50 100644 --- a/kernel/locking/locktorture.c +++ b/kernel/locking/locktorture.c @@ -748,6 +748,15 @@ static void lock_torture_cleanup(void) if (torture_cleanup_begin()) return; + /* + * Indicates early cleanup, meaning that the test has not run, + * such as when passing bogus args when loading the module. As + * such, only perform the underlying torture-specific cleanups, + * and avoid anything related to locktorture. + */ + if (!cxt.lwsa) + goto end; + if (writer_tasks) { for (i = 0; i < cxt.nrealwriters_stress; i++) torture_stop_kthread(lock_torture_writer, @@ -776,6 +785,7 @@ static void lock_torture_cleanup(void) else lock_torture_print_module_parms(cxt.cur_ops, "End of test: SUCCESS"); +end: torture_cleanup_end(); } @@ -870,6 +880,7 @@ static int __init lock_torture_init(void) VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory"); firsterr = -ENOMEM; kfree(cxt.lwsa); + cxt.lwsa = NULL; goto unwind; } @@ -878,6 +889,7 @@ static int __init lock_torture_init(void) cxt.lrsa[i].n_lock_acquired = 0; } } + lock_torture_print_module_parms(cxt.cur_ops, "Start of test"); /* Prepare torture context. */