linux-kernel - Re: [patch] block layer: kmemcheck fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080208113847.GI15220@kernel.dk>
Date:	Fri, 8 Feb 2008 12:38:49 +0100
From:	Jens Axboe <jens.axboe@...cle.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Ingo Molnar <mingo@...e.hu>, linux-kernel@...r.kernel.org,
	Alan.Brunelle@...com, arjan@...ux.intel.com, dgc@....com,
	npiggin@...e.de, Andrew Morton <akpm@...ux-foundation.org>,
	Vegard Nossum <vegard.nossum@...il.com>,
	Pekka Enberg <penberg@...il.com>
Subject: Re: [patch] block layer: kmemcheck fixes

On Thu, Feb 07 2008, Linus Torvalds wrote:
> 
> 
> On Thu, 7 Feb 2008, Ingo Molnar wrote:
> >  	INIT_HLIST_NODE(&rq->hash);
> >  	RB_CLEAR_NODE(&rq->rb_node);
> > -	rq->ioprio = 0;
> > -	rq->buffer = NULL;
> > -	rq->ref_count = 1;
> > -	rq->q = q;
> > -	rq->special = NULL;
> > -	rq->data_len = 0;
> > -	rq->data = NULL;
> > -	rq->nr_phys_segments = 0;
> > -	rq->sense = NULL;
> > -	rq->end_io = NULL;
> > -	rq->end_io_data = NULL;
> > -	rq->completion_data = NULL;
> > -	rq->next_rq = NULL;
> > +	rq->completion_data		= NULL;
> > +	/* rq->elevator_private			*/
> > +	/* rq->elevator_private2		*/
> > +	/* rq->rq_disk				*/
> > +	/* rq->start_time			*/
> > +	rq->nr_phys_segments		= 0;
> > +	/* rq->nr_hw_segments			*/
> > +	rq->ioprio			= 0;
> > +	rq->special			= NULL;
> > +	rq->buffer			= NULL;
> ...
> 
> Can we please just stop doing these one-by-one assignments, and just do 
> something like
> 
> 	memset(rq, 0, sizeof(*rq));
> 	rq->q = q;
> 	rq->ref_count = 1;
> 	INIT_HLIST_NODE(&rq->hash);
> 	RB_CLEAR_NODE(&rq->rb_node);
> 
> instead?
> 
> The memset() is likely faster and smaller than one-by-one assignments 
> anyway, even if the one-by-ones can avoid initializing some field or there 
> ends up being a double initialization..

Looked into this approach and we can't currently do that here, since
some members of the request are being set from blk_alloc_request() and
then from the io scheduler attaching private data to it. So we have to
preserve ->cmd_flags and ->elevator_private and ->elevator_private2 at
least. Now rq_init() is also used for stored requests, so we cannot just
rely on clearing at allocation time.

So I'd prefer being a little conservative here. The below reorders
rq_init() a bit and clears some more members to be on the safer side,
adding comments to why we cannot memset and an associated comment in
blkdev.h.

diff --git a/block/blk-core.c b/block/blk-core.c
index 4afb39c..fba4ca7 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -102,27 +102,38 @@ struct backing_dev_info *blk_get_backing_dev_info(struct block_device *bdev)
 }
 EXPORT_SYMBOL(blk_get_backing_dev_info);
 
+/*
+ * We can't just memset() the structure, since the allocation path
+ * already stored some information in the request.
+ */
 void rq_init(struct request_queue *q, struct request *rq)
 {
 	INIT_LIST_HEAD(&rq->queuelist);
 	INIT_LIST_HEAD(&rq->donelist);
-
-	rq->errors = 0;
+	rq->q = q;
+	rq->sector = rq->hard_sector = (sector_t) -1;
+	rq->nr_sectors = rq->hard_nr_sectors = 0;
+	rq->current_nr_sectors = rq->hard_cur_sectors = 0;
 	rq->bio = rq->biotail = NULL;
 	INIT_HLIST_NODE(&rq->hash);
 	RB_CLEAR_NODE(&rq->rb_node);
+	rq->rq_disk = NULL;
+	rq->nr_phys_segments = 0;
+	rq->nr_hw_segments = 0;
 	rq->ioprio = 0;
+	rq->special = NULL;
 	rq->buffer = NULL;
+	rq->tag = -1;
+	rq->errors = 0;
 	rq->ref_count = 1;
-	rq->q = q;
-	rq->special = NULL;
+	rq->cmd_len = 0;
+	memset(rq->cmd, 0, sizeof(rq->cmd));
 	rq->data_len = 0;
+	rq->sense_len = 0;
 	rq->data = NULL;
-	rq->nr_phys_segments = 0;
 	rq->sense = NULL;
 	rq->end_io = NULL;
 	rq->end_io_data = NULL;
-	rq->completion_data = NULL;
 	rq->next_rq = NULL;
 }
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 90392a9..e1888cc 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -137,7 +137,9 @@ enum rq_flag_bits {
 #define BLK_MAX_CDB	16
 
 /*
- * try to put the fields that are referenced together in the same cacheline
+ * try to put the fields that are referenced together in the same cacheline.
+ * if you modify this structure, be sure to check block/blk-core.c:rq_init()
+ * as well!
  */
 struct request {
 	struct list_head queuelist;


-- 
Jens Axboe

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/