Messages in this thread Patch in this message | | | Date | Thu, 1 Oct 2009 11:07:58 +0100 (BST) | From | Hugh Dickins <> | Subject | Re: [PATCH] swapfile: avoid NULL pointer dereference in swapon when s_bdev is NULL |
| |
On Tue, 29 Sep 2009, Suresh Jayaraman wrote:
> While testing Swap over NFS patchset, I noticed an oops that was triggered > during swapon. Investigating further, the NULL pointer deference is due to the > SSD device check/optimization in the swapon code that assumes s_bdev could never > be NULL. > > inode->i_sb->s_bdev could be NULL in a few cases. For e.g. one such case is > loopback NFS mount, there could be others as well. Fix this by ensuring s_bdev > is not NULL before we try to deference s_bdev. > > Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
Acked-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Thanks a lot for that: sorry to say I was ignorant of the possibility.
This is only an issue with an out-of-tree patch, is that correct? I'd like it to be fixed anyway, but if there's a way in which it can happen in unpatched 2.6.31, then we ought to send the fix to -stable.
I've added Rafael to the Cc, because CONFIG_HIBERNATION's swap_type_of() looks also dangerous in this respect - and especially where it does that "if (bdev == sis->bdev) {" match, I think it's assuming NULL bdev cannot match against anything.
Hugh
> --- > mm/swapfile.c | 12 +++++++----- > 1 files changed, 7 insertions(+), 5 deletions(-) > > diff --git a/mm/swapfile.c b/mm/swapfile.c > index 4de7f02..a1bc6b9 100644 > --- a/mm/swapfile.c > +++ b/mm/swapfile.c > @@ -1974,12 +1974,14 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) > goto bad_swap; > } > > - if (blk_queue_nonrot(bdev_get_queue(p->bdev))) { > - p->flags |= SWP_SOLIDSTATE; > - p->cluster_next = 1 + (random32() % p->highest_bit); > + if (p->bdev) { > + if (blk_queue_nonrot(bdev_get_queue(p->bdev))) { > + p->flags |= SWP_SOLIDSTATE; > + p->cluster_next = 1 + (random32() % p->highest_bit); > + } > + if (discard_swap(p) == 0) > + p->flags |= SWP_DISCARDABLE; > } > - if (discard_swap(p) == 0) > - p->flags |= SWP_DISCARDABLE; > > mutex_lock(&swapon_mutex); > spin_lock(&swap_lock);
| |