linux-kernel - Re: [PATCH] blkmq: Fix NULL pointer deref when all reserved tags in use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5509E2A8.5040905@kernel.dk>
Date:	Wed, 18 Mar 2015 14:40:08 -0600
From:	Jens Axboe <axboe@...nel.dk>
To:	Sam Bradshaw <sbradshaw@...ron.com>
CC:	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] blkmq: Fix NULL pointer deref when all reserved tags
 in use

On 03/18/2015 02:36 PM, Sam Bradshaw wrote:
> When allocating from the reserved tags pool, bt_get() is called with
> a NULL hctx.  If all tags are in use, the hw queue is kicked to push
> out any pending IO, potentially freeing tags, and tag allocation is
> retried.  The problem is that blk_mq_run_hw_queue() doesn't check for
> a NULL hctx.  This patch fixes that bug.
>
> An alternative implementation might skip kicking the queue for reserved
> tags and go right to io_schedule() but we chose to keep it simple.
>
> Tested by hammering mtip32xx with concurrent smartctl/hdparm.
>
> Signed-off-by: Sam Bradshaw <sbradshaw@...ron.com>
> Signed-off-by: Selvan Mani <smani@...ron.com>
> ---
>   block/blk-mq.c |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index 59fa239..0471af6 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -887,7 +887,7 @@ static int blk_mq_hctx_next_cpu(struct blk_mq_hw_ctx *hctx)
>
>   void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
>   {
> -	if (unlikely(test_bit(BLK_MQ_S_STOPPED, &hctx->state) ||
> +	if (unlikely(!hctx || test_bit(BLK_MQ_S_STOPPED, &hctx->state) ||
>   	    !blk_mq_hw_queue_mapped(hctx)))
>   		return;

Good catch! But why not put the hctx == NULL check in as a conditional 
in bt_get() before running the queue? I can't imagine other cases where 
calling blk_mq_run_hw_queue() with hctx == NULL would be a valid scenario.

The bug was introduced with commit b32232073e80, so that should probably
be indicated too.

-- 
Jens Axboe

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/