Messages in this thread | | | Date | Tue, 24 Mar 2009 09:47:17 +0100 | From | Ingo Molnar <> | Subject | Re: [PATCH 3/5] blktrace: fix off-by-one bug |
| |
* Li Zefan <lizf@cn.fujitsu.com> wrote:
> Li Zefan wrote: > >>> - if (unlikely(what == 0 || what > ARRAY_SIZE(what2act))) > >>> + if (unlikely(what == 0 || what >= ARRAY_SIZE(what2act))) > >> ah, nice. How did you notice - did we miss "remap" events due to > >> this bug? > >> > > forgot to mention, we didn't miss any "remap" events. > > > > > By code review, but we can get NULL dereference bug if we receive an > > "abort" event, this event may be generated only when using device-mapper. > > > > and not NULL dereference, but accessing invalid memory. > > what2act["abort"]->print(...) > > and "abort" == ARRAY_SIZE(what2act).
Ah. This:
[__BLK_TA_QUEUE] = {{ "Q", "queue" }, blk_log_generic }, [__BLK_TA_BACKMERGE] = {{ "M", "backmerge" }, blk_log_generic }, [__BLK_TA_FRONTMERGE] = {{ "F", "frontmerge" }, blk_log_generic }, [__BLK_TA_GETRQ] = {{ "G", "getrq" }, blk_log_generic }, [__BLK_TA_SLEEPRQ] = {{ "S", "sleeprq" }, blk_log_generic }, [__BLK_TA_REQUEUE] = {{ "R", "requeue" }, blk_log_with_error }, [__BLK_TA_ISSUE] = {{ "D", "issue" }, blk_log_generic }, [__BLK_TA_COMPLETE] = {{ "C", "complete" }, blk_log_with_error }, [__BLK_TA_PLUG] = {{ "P", "plug" }, blk_log_plug }, [__BLK_TA_UNPLUG_IO] = {{ "U", "unplug_io" }, blk_log_unplug }, [__BLK_TA_UNPLUG_TIMER] = {{ "UT", "unplug_timer" }, blk_log_unplug }, [__BLK_TA_INSERT] = {{ "I", "insert" }, blk_log_generic }, [__BLK_TA_SPLIT] = {{ "X", "split" }, blk_log_split }, [__BLK_TA_BOUNCE] = {{ "B", "bounce" }, blk_log_generic }, [__BLK_TA_REMAP] = {{ "A", "remap" }, blk_log_remap },
does not have a __BLK_TA_ABORT entry currently - it should have, right?
Ingo
| |