linux-kernel - Re: [PATCH] bcache: fix NULL pointer deref in blk_add_request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20140219131857.GC32062@soda.linbit>
Date:	Wed, 19 Feb 2014 14:18:58 +0100
From:	Lars Ellenberg <lars@...bit.com>
To:	Kent Overstreet <kmo@...erainc.com>
Cc:	Neil Brown <neilb@...e.de>, linux-bcache@...r.kernel.org,
	linux-raid@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] bcache: fix NULL pointer deref in blk_add_request_payload

On Wed, Feb 19, 2014 at 01:07:14PM +0000, Lars Ellenberg wrote:
> bch_generic_make_request_hack() tries to be smart,
> and fake a bi_max_bvecs = bi_vcnt.

I meant to include a cover letter with the Oops backtrace,
and this:

Note that this patch is relevant for 3.13 and before.

With 3.14,
this whole bch_generic_make_request_hack() function has been dropped already.

Thanks,

	Lars

> If those bios have been REQ_DISCARD, and get submitted to a driver
> (md raid) that uses bio_clone, the clone will end up with bi_io_vec == NULL,
> passed down the stack, end up in sd_prep_fn and blk_add_request_payload,
> which then tries to use bio->bi_io_vec->page.
> 
> Fix: try to be even smarter in bch_generic_make_request_hack(),
> and always pretend to have at least bi_max_vecs of 1,
> unless the incoming bio was already created without a single bvec.
> 
> Signed-off-by: Lars Ellenberg <lars@...bit.com>
> ---
>  drivers/md/bcache/io.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
> index 9056632..a638ac6 100644
> --- a/drivers/md/bcache/io.c
> +++ b/drivers/md/bcache/io.c
> @@ -47,7 +47,7 @@ static void bch_generic_make_request_hack(struct bio *bio)
>  	 *
>  	 * To be taken out once immutable bvec stuff is in.
>  	 */
> -	bio->bi_max_vecs = bio->bi_vcnt;
> +	bio->bi_max_vecs = bio->bi_vcnt ?: (bio->bi_io_vec ? 1 : 0);
>  
>  	generic_make_request(bio);
>  }
> -- 
> 1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/