linux-kernel - [PATCH] blkmq: Fix NULL pointer deref when all reserved tags in use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5509E1D0.2080908@micron.com>
Date:	Wed, 18 Mar 2015 13:36:32 -0700
From:	Sam Bradshaw <sbradshaw@...ron.com>
To:	<axboe@...nel.dk>
CC:	<linux-kernel@...r.kernel.org>
Subject: [PATCH] blkmq: Fix NULL pointer deref when all reserved tags in use

When allocating from the reserved tags pool, bt_get() is called with 
a NULL hctx.  If all tags are in use, the hw queue is kicked to push 
out any pending IO, potentially freeing tags, and tag allocation is 
retried.  The problem is that blk_mq_run_hw_queue() doesn't check for 
a NULL hctx.  This patch fixes that bug.

An alternative implementation might skip kicking the queue for reserved 
tags and go right to io_schedule() but we chose to keep it simple.

Tested by hammering mtip32xx with concurrent smartctl/hdparm.

Signed-off-by: Sam Bradshaw <sbradshaw@...ron.com>
Signed-off-by: Selvan Mani <smani@...ron.com>
---
 block/blk-mq.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 59fa239..0471af6 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -887,7 +887,7 @@ static int blk_mq_hctx_next_cpu(struct blk_mq_hw_ctx *hctx)

 void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
 {
-	if (unlikely(test_bit(BLK_MQ_S_STOPPED, &hctx->state) ||
+	if (unlikely(!hctx || test_bit(BLK_MQ_S_STOPPED, &hctx->state) ||
 	    !blk_mq_hw_queue_mapped(hctx)))
 		return;

-- 
1.7.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/