null_blk: prevent NULL dereference in null_init_tag_set()

PATCH Applied Dan Carpenter 4 participants 6 messages Jul 15, 2022

Subsystems (2)

Block layer Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2022-07-15 08:12 UTC #0 lore raw

PATCH 1/2 null_blk: prevent NULL dereference in null_init_tag_set()

The "nullb" pointer can be NULL. Smatch prints a warning about this:

drivers/block/null_blk/main.c:1914 null_init_tag_set()
error: we previously assumed 'nullb' could be null (see line 1911)

Fixes 37ae152c7a0d ("null_blk: add configfs variables for 2 options")

Signed-off-by Dan Carpenter <[email protected]>

---
 drivers/block/null_blk/main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/block/null_blk/main.c +2 -2

index 67c17e5d2c99..016ec3a2f98f 100644
@@ -1911,9 +1911,9 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)
 	set->numa_node = nullb ? nullb->dev->home_node : g_home_node;
 	set->cmd_size	= sizeof(struct nullb_cmd);
 	set->flags = BLK_MQ_F_SHOULD_MERGE;
-	if (nullb->dev->no_sched)
+	if (nullb && nullb->dev->no_sched)
 		set->flags |= BLK_MQ_F_NO_SCHED;
-	if (nullb->dev->shared_tag_bitmap)
+	if (nullb && nullb->dev->shared_tag_bitmap)
 		set->flags |= BLK_MQ_F_TAG_HCTX_SHARED;
 	set->driver_data = nullb;
 	if (poll_queues)

Signature · 1 line

2.35.1

Dan Carpenter

author

2022-07-15 08:12 UTC #1 lore raw

PATCH 2/2 null_blk: fix ida error handling in null_add_dev()

There needs to be some error checking if ida_simple_get() fails. Also call ida_free() if there are errors later.

Fixes 94bc02e30fb8 ("nullb: use ida to manage index")

Signed-off-by Dan Carpenter <[email protected]>

---
 drivers/block/null_blk/main.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

drivers/block/null_blk/main.c +11 -3

index 016ec3a2f98f..3d334d46d5f6 100644
@@ -2074,8 +2074,13 @@ static int null_add_dev(struct nullb_device *dev)
 	blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, nullb->q);
 
 	mutex_lock(&lock);
-	nullb->index = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
-	dev->index = nullb->index;
+	rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
+	if (rv < 0) {
+		mutex_unlock(&lock);
+		goto out_cleanup_zone;
+	}
+	nullb->index = rv;
+	dev->index = rv;
 	mutex_unlock(&lock);
 
 	blk_queue_logical_block_size(nullb->q, dev->blocksize);

@@ -2101,7 +2106,7 @@ static int null_add_dev(struct nullb_device *dev)
 
 	rv = null_gendisk_register(nullb);
 	if (rv)
-		goto out_cleanup_zone;
+		goto out_ida_free;
 
 	mutex_lock(&lock);
 	list_add_tail(&nullb->list, &nullb_list);

@@ -2110,6 +2115,9 @@ static int null_add_dev(struct nullb_device *dev)
 	pr_info("disk %s created\n", nullb->disk_name);
 
 	return 0;
+
+out_ida_free:
+	ida_free(&nullb_indexes, nullb->index);
 out_cleanup_zone:
 	null_free_zoned_dev(dev);
 out_cleanup_disk:

Signature · 1 line

2.35.1

Johannes Thumshirn

2022-07-15 08:23 UTC #2 lore raw

Re: [PATCH 2/2] null_blk: fix ida error handling in null_add_dev()

drivers/block/null_blk/main.c static int null_add_dev(struct nullb_device *dev) · line 2083

Quoted 9 lines · Dan Carpenter

drivers/block/null_blk/main.c +7 -2

-	nullb->index = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
-	dev->index = nullb->index;
+	rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
+	if (rv < 0) {
+		mutex_unlock(&lock);
+		goto out_cleanup_zone;
+	}
+	nullb->index = rv;
+	dev->index = rv;

Isn't ida_simple_get() deprecated? And actually the 'max' argument is 0 here, so ida_alloc_range() tries to allocate a number between 0 and 0?

Dan Carpenter

author

2022-07-15 09:16 UTC #3 lore raw

Re: [PATCH 2/2] null_blk: fix ida error handling in null_add_dev()

Quoted 13 lines · Johannes Thumshirn

drivers/block/null_blk/main.c static int null_add_dev(struct nullb_device *dev) · line 2083
Quoted 9 lines · Dan Carpenter
drivers/block/null_blk/main.c +7 -2
-	nullb->index = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
-	dev->index = nullb->index;
+	rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
+	if (rv < 0) {
+		mutex_unlock(&lock);
+		goto out_cleanup_zone;
+	}
+	nullb->index = rv;
+	dev->index = rv;
Isn't ida_simple_get() deprecated? And actually the 'max' argument is 0 here, so ida_alloc_range() tries to allocate a number between 0 and 0?

That was already there in the original code. I was just fixing the bugs, not doing cleanup.

The second zero means use INT_MAX. (When a function has "simple" in the name it is always intended ironically).

regards,
dan carpenter

Ming Lei

2022-07-15 09:26 UTC #4 lore raw

In reply to Dan Carpenter

Hello Dan,

Quoted 7 lines · Dan Carpenter

The "nullb" pointer can be NULL. Smatch prints a warning about this:
drivers/block/null_blk/main.c:1914 null_init_tag_set()
error: we previously assumed 'nullb' could be null (see line 1911)
Fixes 37ae152c7a0d ("null_blk: add configfs variables for 2 options")
Signed-off-by Dan Carpenter <[email protected]>

FYI,

I have posted another fix/cleanup for this issue:

https://lore.kernel.org/linux-block/[email protected]/T/#u

Thanks,
Ming

Jens Axboe

maintainer Applied

2022-07-15 15:05 UTC #5 lore raw

Re: (subset) [PATCH 1/2] null_blk: prevent NULL dereference in null_init_tag_set()

In reply to Dan Carpenter

Quoted 6 lines · Dan Carpenter

The "nullb" pointer can be NULL. Smatch prints a warning about this:
drivers/block/null_blk/main.c:1914 null_init_tag_set()
error: we previously assumed 'nullb' could be null (see line 1911)

Applied, thanks!

[2/2] null_blk: fix ida error handling in null_add_dev()

      commit: 8c740c6bf12dec03b6f35b19fe6c183929d0b88a

Best regards,

Signature · 1 line

Jens Axboe