lkml.org 
[lkml]   [2007]   [Mar]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: PROBLEM: null pointer dereference in cfq_dispatch_requests (2.6.21-rc2 and 2.6.20)
    Hi,

    I think I found where the NULL may come from. Please, anybody, do not
    apply this patch before a trustful person reviewed it... Jens? ;)

    My thoughts on this are, that there are two possibilities cfqq->next_rq
    could be NULL: End of list or a bug when it is set (or not set).
    But why does RB_EMPTY_ROOT() as last call in this loop does not trigger?

    Did I even get the right place on where the NULL pointer dereference
    happens? :)

    =Hannes

    Signed-off-by: Johannes Weiner <hannes-kernel@saeurebad.de>
    diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
    index b6491c0..ca84f0b 100644
    --- a/block/cfq-iosched.c
    +++ b/block/cfq-iosched.c
    @@ -961,8 +961,8 @@ __cfq_dispatch_requests(struct cfq_data *cfqd, struct cfq_queue *cfqq,
    /*
    * follow expired path, else get first next available
    */
    - if ((rq = cfq_check_fifo(cfqq)) == NULL)
    - rq = cfqq->next_rq;
    + if (!(rq = cfq_check_fifo(cfqq)) && !(rq = cfqq->next_rq))
    + break;

    /*
    * finally, insert request into driver dispatch list
    \
     
     \ /
      Last update: 2007-03-21 20:07    [W:4.276 / U:0.148 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site