lkml.org 
[lkml]   [2014]   [Jan]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC PATCH V3 2/2] fs : Add sanity checks for block size > PAGE_SIZE
    On Tue, 21 Jan 2014 17:00:00 +0530 Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com> wrote:

    > We could hit null pointer dereference error during alloc_page_buffers
    > in : (1) block size > PAGE_SIZE (2) low memory.
    > Add sanity check for that.
    >
    > Signed-off-by: Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com>
    > ---
    > fs/block_dev.c | 1 +
    > fs/buffer.c | 6 ++++++
    > 2 files changed, 7 insertions(+)
    >
    > diff --git a/fs/block_dev.c b/fs/block_dev.c
    > index 1e86823..2481d42 100644
    > --- a/fs/block_dev.c
    > +++ b/fs/block_dev.c
    > @@ -1027,6 +1027,7 @@ void bd_set_size(struct block_device *bdev, loff_t size)
    > break;
    > bsize <<= 1;
    > }
    > + BUG_ON(bsize > PAGE_SIZE);
    > bdev->bd_block_size = bsize;
    > bdev->bd_inode->i_blkbits = blksize_bits(bsize);
    > }

    alloc_page_buffers() will always return NULL if passed size >=
    PAGE_SIZE. So if we're going to add a check, it would be better to add
    it to alloc_page_buffers() because that will catch errors from the
    widest range of callsites.

    But alloc_page_buffers() is pretty frequently called and I'd be
    inclined to not add any check - most callers will just go oops and that
    will provide basically the same information.

    > --- a/fs/buffer.c
    > +++ b/fs/buffer.c
    > @@ -1571,6 +1571,12 @@ void create_empty_buffers(struct page *page,
    > struct buffer_head *bh, *head, *tail;
    >
    > head = alloc_page_buffers(page, blocksize, 1);
    > +
    > + /*
    > + * alloc_page_buffers() could return NULL on (1) bs > PAGE_SIZE
    > + * (2) low memory case. Ensure that we don't dereference null ptr
    > + */
    > + BUG_ON(!head);

    This is unneeded.

    - bs > PAGE_SIZE can be checked elsewhere in a direct fashion

    - low memory case can't happen - we passed retry=1

    - create_empty_buffers() will immediately go oops if head==NULL.
    That oops contains the same info as is presented by a BUG().



    \
     
     \ /
      Last update: 2014-01-21 22:01    [W:8.265 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site