From: Al Viro <viro@ZenIV.linux.org.uk>
To: Nicolas Pitre <nicolas.pitre@linaro.org>
Cc: Christoph Hellwig <hch@infradead.org>,
linux-fsdevel@vger.kernel.org, linux-mm@kvack.org,
linux-embedded@vger.kernel.org, linux-kernel@vger.kernel.org,
Chris Brandt <Chris.Brandt@renesas.com>
Subject: Re: [PATCH v6 1/4] cramfs: direct memory access support
Date: Fri, 13 Oct 2017 18:52:08 +0100 [thread overview]
Message-ID: <20171013175208.GI21978@ZenIV.linux.org.uk> (raw)
In-Reply-To: <nycvar.YSQ.7.76.1710131332360.1718@knanqh.ubzr>
On Fri, Oct 13, 2017 at 01:39:13PM -0400, Nicolas Pitre wrote:
> On Fri, 13 Oct 2017, Al Viro wrote:
>
> > On Thu, Oct 12, 2017 at 02:16:10AM -0400, Nicolas Pitre wrote:
> >
> > > static void cramfs_kill_sb(struct super_block *sb)
> > > {
> > > struct cramfs_sb_info *sbi = CRAMFS_SB(sb);
> > >
> > > - kill_block_super(sb);
> > > + if (IS_ENABLED(CCONFIG_CRAMFS_MTD)) {
> > > + if (sbi->mtd_point_size)
> > > + mtd_unpoint(sb->s_mtd, 0, sbi->mtd_point_size);
> > > + if (sb->s_mtd)
> > > + kill_mtd_super(sb);
> >
> > ...
> >
> > > + mtd_unpoint(sb->s_mtd, 0, PAGE_SIZE);
> > > + err = mtd_point(sb->s_mtd, 0, sbi->size, &sbi->mtd_point_size,
> > > + &sbi->linear_virt_addr, &sbi->linear_phys_addr);
> > > + if (err || sbi->mtd_point_size != sbi->size) {
> >
> > What happens if that mtd_point() fails? Note that ->kill_sb() will be
> > called anyway and ->mtd_point_size is going to be non-zero here...
>
> mtd_point() always clears sbi->mtd_point_size first thing upon entry
> even before it has a chance to fail. So it it fails then
> sbi->mtd_point_size will be zero and ->kill_sb() will skip the unpoint
> call.
OK... I wonder if it should simply define stubs for kill_mtd_super(),
mtd_unpoint() and kill_block_super() in !CONFIG_MTD and !CONFIG_BLOCK
cases. mount_mtd() and mount_bdev() as well - e.g. mount_bdev()
returning ERR_PTR(-ENODEV) and kill_block_super() being simply BUG()
in !CONFIG_BLOCK case. Then cramfs_kill_sb() would be
if (sb->s_mtd) {
if (sbi->mtd_point_size)
mtd_unpoint(sb->s_mtd, 0, sbi->mtd_point_size);
kill_mtd_super(sb);
} else {
kill_block_super(sb);
}
kfree(sbi);
Wait. Looking at that code... what happens if you hit this failure
exit:
sbi = kzalloc(sizeof(struct cramfs_sb_info), GFP_KERNEL);
if (!sbi)
return -ENOMEM;
Current cramfs_kill_sb() will do kill_block_super() and kfree(NULL), which
works nicely, but you are dereferencing that sucker, not just passing it
to kfree(). IOW, that if (sbi->....) ought to be if (sbi && sbi->...)
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2017-10-13 17:52 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-12 6:16 [PATCH v6 0/4] cramfs refresh for embedded usage Nicolas Pitre
2017-10-12 6:16 ` [PATCH v6 1/4] cramfs: direct memory access support Nicolas Pitre
2017-10-12 17:03 ` Chris Brandt
2017-10-13 1:20 ` Nicolas Pitre
2017-10-13 7:30 ` Christoph Hellwig
2017-10-13 17:29 ` Al Viro
2017-10-13 17:39 ` Nicolas Pitre
2017-10-13 17:52 ` Al Viro [this message]
2017-10-13 18:18 ` Nicolas Pitre
2017-10-13 20:09 ` Nicolas Pitre
2017-10-14 0:31 ` Al Viro
2017-10-14 2:25 ` Nicolas Pitre
2017-10-14 2:37 ` Nicolas Pitre
2017-10-12 6:16 ` [PATCH v6 2/4] cramfs: implement uncompressed and arbitrary data block positioning Nicolas Pitre
2017-10-12 6:16 ` [PATCH v6 3/4] cramfs: add mmap support Nicolas Pitre
2017-10-13 7:31 ` Christoph Hellwig
2017-10-12 6:16 ` [PATCH v6 4/4] cramfs: rehabilitate it Nicolas Pitre
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171013175208.GI21978@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=Chris.Brandt@renesas.com \
--cc=hch@infradead.org \
--cc=linux-embedded@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=nicolas.pitre@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).