linux-kernel - Re: KASAN: null-ptr-deref Write in blk_mq_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <523c2b61-476e-0fb6-12d9-37038d150fb7@acm.org>
Date:   Thu, 26 Mar 2020 19:52:06 -0700
From:   Bart Van Assche <bvanassche@....org>
To:     Dongli Zhang <dongli.zhang@...cle.com>,
        syzbot <syzbot+313d95e8a7a49263f88d@...kaller.appspotmail.com>,
        axboe@...nel.dk, linux-block@...r.kernel.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue

On 2020-03-26 17:19, Dongli Zhang wrote:
> I think the issue is because of line 2827, that is, the q->nr_hw_queues is
> updated too earlier. It is still possible the init would fail later.
> 
> 2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
> 2810                                                 struct request_queue *q)
> 2811 {
> 2812         int i, j, end;
> 2813         struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
> 2814
> 2815         if (q->nr_hw_queues < set->nr_hw_queues) {
> 2816                 struct blk_mq_hw_ctx **new_hctxs;
> 2817
> 2818                 new_hctxs = kcalloc_node(set->nr_hw_queues,
> 2819                                        sizeof(*new_hctxs), GFP_KERNEL,
> 2820                                        set->numa_node);
> 2821                 if (!new_hctxs)
> 2822                         return;
> 2823                 if (hctxs)
> 2824                         memcpy(new_hctxs, hctxs, q->nr_hw_queues *
> 2825                                sizeof(*hctxs));
> 2826                 q->queue_hw_ctx = new_hctxs;
> 2827                 q->nr_hw_queues = set->nr_hw_queues;
> 2828                 kfree(hctxs);
> 2829                 hctxs = new_hctxs;
> 2830         }

Which kernel tree does this syzbot report refer to? Commit
d0930bb8f46b ("blk-mq: Fix a recently introduced regression in
blk_mq_realloc_hw_ctxs()") in Jens' tree removed line 2827 shown above.

Thanks,

Bart.