linux-kernel - [axboe-block:for-5.17/block 106/108] block/blk-ioc.c:307 set_task_ioprio() error: we previously assumed 'task->io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <202112171520.5hNnOM0q-lkp@intel.com>
Date:   Fri, 17 Dec 2021 10:49:01 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Christoph Hellwig <hch@....de>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org, Jens Axboe <axboe@...nel.dk>,
        Jan Kara <jack@...e.cz>
Subject: [axboe-block:for-5.17/block 106/108] block/blk-ioc.c:307
 set_task_ioprio() error: we previously assumed 'task->io_context' could be
 null (see line 300)

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-5.17/block
head:   5ef1630586317e92c9ebd7b4ce48f393b7ff790f
commit: 5fc11eebb4a98df5324a4de369bb5ab7f0007ff7 [106/108] block: open code create_task_io_context in set_task_ioprio
config: i386-randconfig-m021-20211216 (https://download.01.org/0day-ci/archive/20211217/202112171520.5hNnOM0q-lkp@intel.com/config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
block/blk-ioc.c:307 set_task_ioprio() error: we previously assumed 'task->io_context' could be null (see line 300)

vim +307 block/blk-ioc.c

a411cd3cfdc5bb Christoph Hellwig 2021-12-09  271  int set_task_ioprio(struct task_struct *task, int ioprio)
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  272  {
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  273  	int err;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  274  	const struct cred *cred = current_cred(), *tcred;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  275  
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  276  	rcu_read_lock();
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  277  	tcred = __task_cred(task);
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  278  	if (!uid_eq(tcred->uid, cred->euid) &&
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  279  	    !uid_eq(tcred->uid, cred->uid) && !capable(CAP_SYS_NICE)) {
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  280  		rcu_read_unlock();
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  281  		return -EPERM;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  282  	}
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  283  	rcu_read_unlock();
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  284  
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  285  	err = security_task_setioprio(task, ioprio);
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  286  	if (err)
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  287  		return err;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  288  
8472161b77c41d Christoph Hellwig 2021-12-09  289  	task_lock(task);
8472161b77c41d Christoph Hellwig 2021-12-09  290  	if (unlikely(!task->io_context)) {
8472161b77c41d Christoph Hellwig 2021-12-09  291  		struct io_context *ioc;
8472161b77c41d Christoph Hellwig 2021-12-09  292  
8472161b77c41d Christoph Hellwig 2021-12-09  293  		task_unlock(task);
5fc11eebb4a98d Christoph Hellwig 2021-12-09  294  
5fc11eebb4a98d Christoph Hellwig 2021-12-09  295  		ioc = alloc_io_context(GFP_ATOMIC, NUMA_NO_NODE);
5fc11eebb4a98d Christoph Hellwig 2021-12-09  296  		if (!ioc)
5fc11eebb4a98d Christoph Hellwig 2021-12-09  297  			return -ENOMEM;
5fc11eebb4a98d Christoph Hellwig 2021-12-09  298  
5fc11eebb4a98d Christoph Hellwig 2021-12-09  299  		task_lock(task);
5fc11eebb4a98d Christoph Hellwig 2021-12-09 @300  		if (task->io_context || (task->flags & PF_EXITING)) {
                                                                                         ^^^^^^^^^^^^^^^^^^^^^^^^
Assume "task->io_context" is NULL but PF_EXITING is set.

5fc11eebb4a98d Christoph Hellwig 2021-12-09  301  			kmem_cache_free(iocontext_cachep, ioc);
5fc11eebb4a98d Christoph Hellwig 2021-12-09  302  			ioc = task->io_context;
5fc11eebb4a98d Christoph Hellwig 2021-12-09  303  		} else {
5fc11eebb4a98d Christoph Hellwig 2021-12-09  304  			task->io_context = ioc;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  305  		}
8472161b77c41d Christoph Hellwig 2021-12-09  306  	}
8472161b77c41d Christoph Hellwig 2021-12-09 @307  	task->io_context->ioprio = ioprio;
                                                        ^^^^^^^^^^^^^^^^^^
Unchecked dereference.

8472161b77c41d Christoph Hellwig 2021-12-09  308  	task_unlock(task);
8472161b77c41d Christoph Hellwig 2021-12-09  309  	return 0;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  310  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org