Re: NULL pointer dereference in swsusp_free with 3.17-rc5

[Joerg Roedel <jroedel@suse.de>]

On Wed, Sep 24, 2014 at 09:45:26AM +0200, Bjørn Mork wrote:
> >> Thanks.  Yes, you were correct. The bad commit is
> >> 
> >>  6efde38f0769 PM / Hibernate: Iterate over set bits instead of PFNs in swsu=
> >> sp_free()
> >> 
> >> I have confirmed that reverting only this commit on top of a clean
> >> v3.17-rc6 fixes the problem.  I am attaching the context-modified revert
> >> patch I used.

This is weird, because ...

> >
> > Instead of reverting the commit, can you please check if adding an "if (page)"
> > check around 
> >
> > 		memory_bm_clear_current(forbidden_pages_map);
> > 		memory_bm_clear_current(free_pages_map);
> > 		__free_page(page);
> >
> > in swsusp_free() makes the NULL pointer deref go away?
> 
> Tested.  But on a hunch, I also added this just to be sure:
> 
> 
> @@ -1343,7 +1343,15 @@ void swsusp_free(void)
>  {
>         unsigned long fb_pfn, fr_pfn;
>  
> +WARN_ON(!forbidden_pages_map);
> +if (!forbidden_pages_map)
> +       return;
> +
>         memory_bm_position_reset(forbidden_pages_map);
> +WARN_ON(!free_pages_map);
> +if (!free_pages_map)
> +       return;
> +
>         memory_bm_position_reset(free_pages_map);

... the old code did not check for a valid forbidden_pages_map and
free_pages_map either, so it should crash there too.


	Joerg