linux-kernel - Re: PROBLEM: null pointer dereference in cfq_dispatch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 22 Mar 2007 19:42:35 +0100
From:	Jens Axboe <jens.axboe@...cle.com>
To:	Dale Blount <linux-kernel@...e.us>, linux-kernel@...r.kernel.org
Subject: Re: PROBLEM: null pointer dereference in cfq_dispatch_requests (2.6.21-rc2 and 2.6.20)

On Wed, Mar 21 2007, Johannes Weiner wrote:
> Hi,
> 
> I think I found where the NULL may come from.  Please, anybody, do not
> apply this patch before a trustful person reviewed it... Jens? ;)
> 
> My thoughts on this are, that there are two possibilities cfqq->next_rq
> could be NULL: End of list or a bug when it is set (or not set).
> But why does RB_EMPTY_ROOT() as last call in this loop does not trigger?
> 
> Did I even get the right place on where the NULL pointer dereference
> happens? :)
> 
> =Hannes
> 
> Signed-off-by: Johannes Weiner <hannes-kernel@...urebad.de>

> diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
> index b6491c0..ca84f0b 100644
> --- a/block/cfq-iosched.c
> +++ b/block/cfq-iosched.c
> @@ -961,8 +961,8 @@ __cfq_dispatch_requests(struct cfq_data *cfqd, struct cfq_queue *cfqq,
>  		/*
>  		 * follow expired path, else get first next available
>  		 */
> -		if ((rq = cfq_check_fifo(cfqq)) == NULL)
> -			rq = cfqq->next_rq;
> +		if (!(rq = cfq_check_fifo(cfqq)) && !(rq = cfqq->next_rq))
> +			break;

That still only hides a bug. It is illegal for ->next_rq to be NULL
while the RB tree is non-empty.


-- 
Jens Axboe

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/