* [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set()
@ 2022-07-15 8:10 Dan Carpenter
2022-07-15 8:12 ` [PATCH 2/2] null_blk: fix ida error handling in null_add_dev() Dan Carpenter
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Dan Carpenter @ 2022-07-15 8:10 UTC (permalink / raw)
To: Jens Axboe, Vincent Fu
Cc: Chaitanya Kulkarni, Damien Le Moal, Johannes Thumshirn, Ming Lei,
Shin'ichiro Kawasaki, linux-block, kernel-janitors
The "nullb" pointer can be NULL. Smatch prints a warning about this:
drivers/block/null_blk/main.c:1914 null_init_tag_set()
error: we previously assumed 'nullb' could be null (see line 1911)
Fixes: 37ae152c7a0d ("null_blk: add configfs variables for 2 options")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/block/null_blk/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index 67c17e5d2c99..016ec3a2f98f 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -1911,9 +1911,9 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)
set->numa_node = nullb ? nullb->dev->home_node : g_home_node;
set->cmd_size = sizeof(struct nullb_cmd);
set->flags = BLK_MQ_F_SHOULD_MERGE;
- if (nullb->dev->no_sched)
+ if (nullb && nullb->dev->no_sched)
set->flags |= BLK_MQ_F_NO_SCHED;
- if (nullb->dev->shared_tag_bitmap)
+ if (nullb && nullb->dev->shared_tag_bitmap)
set->flags |= BLK_MQ_F_TAG_HCTX_SHARED;
set->driver_data = nullb;
if (poll_queues)
--
2.35.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] null_blk: fix ida error handling in null_add_dev()
2022-07-15 8:10 [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set() Dan Carpenter
@ 2022-07-15 8:12 ` Dan Carpenter
2022-07-15 8:23 ` Johannes Thumshirn
2022-07-15 9:26 ` [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set() Ming Lei
2022-07-15 15:05 ` (subset) " Jens Axboe
2 siblings, 1 reply; 6+ messages in thread
From: Dan Carpenter @ 2022-07-15 8:12 UTC (permalink / raw)
To: Jens Axboe, Shaohua Li
Cc: Chaitanya Kulkarni, Damien Le Moal, Johannes Thumshirn, Ming Lei,
Vincent Fu, Shin'ichiro Kawasaki, linux-block,
kernel-janitors
There needs to be some error checking if ida_simple_get() fails.
Also call ida_free() if there are errors later.
Fixes: 94bc02e30fb8 ("nullb: use ida to manage index")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/block/null_blk/main.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index 016ec3a2f98f..3d334d46d5f6 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -2074,8 +2074,13 @@ static int null_add_dev(struct nullb_device *dev)
blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, nullb->q);
mutex_lock(&lock);
- nullb->index = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
- dev->index = nullb->index;
+ rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
+ if (rv < 0) {
+ mutex_unlock(&lock);
+ goto out_cleanup_zone;
+ }
+ nullb->index = rv;
+ dev->index = rv;
mutex_unlock(&lock);
blk_queue_logical_block_size(nullb->q, dev->blocksize);
@@ -2101,7 +2106,7 @@ static int null_add_dev(struct nullb_device *dev)
rv = null_gendisk_register(nullb);
if (rv)
- goto out_cleanup_zone;
+ goto out_ida_free;
mutex_lock(&lock);
list_add_tail(&nullb->list, &nullb_list);
@@ -2110,6 +2115,9 @@ static int null_add_dev(struct nullb_device *dev)
pr_info("disk %s created\n", nullb->disk_name);
return 0;
+
+out_ida_free:
+ ida_free(&nullb_indexes, nullb->index);
out_cleanup_zone:
null_free_zoned_dev(dev);
out_cleanup_disk:
--
2.35.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] null_blk: fix ida error handling in null_add_dev()
2022-07-15 8:12 ` [PATCH 2/2] null_blk: fix ida error handling in null_add_dev() Dan Carpenter
@ 2022-07-15 8:23 ` Johannes Thumshirn
2022-07-15 9:14 ` Dan Carpenter
0 siblings, 1 reply; 6+ messages in thread
From: Johannes Thumshirn @ 2022-07-15 8:23 UTC (permalink / raw)
To: Dan Carpenter, Jens Axboe, Shaohua Li
Cc: Chaitanya Kulkarni, Damien Le Moal, Ming Lei, Vincent Fu,
Shinichiro Kawasaki, linux-block@vger.kernel.org,
kernel-janitors@vger.kernel.org
On 15.07.22 10:12, Dan Carpenter wrote:
> - nullb->index = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
> - dev->index = nullb->index;
> + rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
> + if (rv < 0) {
> + mutex_unlock(&lock);
> + goto out_cleanup_zone;
> + }
> + nullb->index = rv;
> + dev->index = rv;
Isn't ida_simple_get() deprecated? And actually the 'max' argument is 0 here,
so ida_alloc_range() tries to allocate a number between 0 and 0?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] null_blk: fix ida error handling in null_add_dev()
2022-07-15 8:23 ` Johannes Thumshirn
@ 2022-07-15 9:14 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2022-07-15 9:14 UTC (permalink / raw)
To: Johannes Thumshirn
Cc: Jens Axboe, Shaohua Li, Chaitanya Kulkarni, Damien Le Moal,
Ming Lei, Vincent Fu, Shinichiro Kawasaki,
linux-block@vger.kernel.org, kernel-janitors@vger.kernel.org
On Fri, Jul 15, 2022 at 08:23:24AM +0000, Johannes Thumshirn wrote:
> On 15.07.22 10:12, Dan Carpenter wrote:
> > - nullb->index = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
> > - dev->index = nullb->index;
> > + rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
> > + if (rv < 0) {
> > + mutex_unlock(&lock);
> > + goto out_cleanup_zone;
> > + }
> > + nullb->index = rv;
> > + dev->index = rv;
>
> Isn't ida_simple_get() deprecated? And actually the 'max' argument is 0 here,
> so ida_alloc_range() tries to allocate a number between 0 and 0?
That was already there in the original code. I was just fixing the bugs,
not doing cleanup.
The second zero means use INT_MAX. (When a function has "simple" in
the name it is always intended ironically).
regards,
dan carpenter
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set()
2022-07-15 8:10 [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set() Dan Carpenter
2022-07-15 8:12 ` [PATCH 2/2] null_blk: fix ida error handling in null_add_dev() Dan Carpenter
@ 2022-07-15 9:26 ` Ming Lei
2022-07-15 15:05 ` (subset) " Jens Axboe
2 siblings, 0 replies; 6+ messages in thread
From: Ming Lei @ 2022-07-15 9:26 UTC (permalink / raw)
To: Dan Carpenter
Cc: Jens Axboe, Vincent Fu, Chaitanya Kulkarni, Damien Le Moal,
Johannes Thumshirn, Shin'ichiro Kawasaki, linux-block,
kernel-janitors
Hello Dan,
On Fri, Jul 15, 2022 at 11:10:50AM +0300, Dan Carpenter wrote:
> The "nullb" pointer can be NULL. Smatch prints a warning about this:
>
> drivers/block/null_blk/main.c:1914 null_init_tag_set()
> error: we previously assumed 'nullb' could be null (see line 1911)
>
> Fixes: 37ae152c7a0d ("null_blk: add configfs variables for 2 options")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
FYI,
I have posted another fix/cleanup for this issue:
https://lore.kernel.org/linux-block/20220715031916.151469-1-ming.lei@redhat.com/T/#u
Thanks,
Ming
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: (subset) [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set()
2022-07-15 8:10 [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set() Dan Carpenter
2022-07-15 8:12 ` [PATCH 2/2] null_blk: fix ida error handling in null_add_dev() Dan Carpenter
2022-07-15 9:26 ` [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set() Ming Lei
@ 2022-07-15 15:05 ` Jens Axboe
2 siblings, 0 replies; 6+ messages in thread
From: Jens Axboe @ 2022-07-15 15:05 UTC (permalink / raw)
To: vincent.fu, dan.carpenter
Cc: linux-block, ming.lei, johannes.thumshirn, kernel-janitors,
damien.lemoal, kch, shinichiro.kawasaki
On Fri, 15 Jul 2022 11:10:50 +0300, Dan Carpenter wrote:
> The "nullb" pointer can be NULL. Smatch prints a warning about this:
>
> drivers/block/null_blk/main.c:1914 null_init_tag_set()
> error: we previously assumed 'nullb' could be null (see line 1911)
>
>
Applied, thanks!
[2/2] null_blk: fix ida error handling in null_add_dev()
commit: 8c740c6bf12dec03b6f35b19fe6c183929d0b88a
Best regards,
--
Jens Axboe
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-07-15 15:05 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-07-15 8:10 [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set() Dan Carpenter
2022-07-15 8:12 ` [PATCH 2/2] null_blk: fix ida error handling in null_add_dev() Dan Carpenter
2022-07-15 8:23 ` Johannes Thumshirn
2022-07-15 9:14 ` Dan Carpenter
2022-07-15 9:26 ` [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set() Ming Lei
2022-07-15 15:05 ` (subset) " Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).