lkml.org 
[lkml]   [2020]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
From
Date
On 2020-03-26 17:19, Dongli Zhang wrote:
> I think the issue is because of line 2827, that is, the q->nr_hw_queues is
> updated too earlier. It is still possible the init would fail later.
>
> 2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
> 2810 struct request_queue *q)
> 2811 {
> 2812 int i, j, end;
> 2813 struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
> 2814
> 2815 if (q->nr_hw_queues < set->nr_hw_queues) {
> 2816 struct blk_mq_hw_ctx **new_hctxs;
> 2817
> 2818 new_hctxs = kcalloc_node(set->nr_hw_queues,
> 2819 sizeof(*new_hctxs), GFP_KERNEL,
> 2820 set->numa_node);
> 2821 if (!new_hctxs)
> 2822 return;
> 2823 if (hctxs)
> 2824 memcpy(new_hctxs, hctxs, q->nr_hw_queues *
> 2825 sizeof(*hctxs));
> 2826 q->queue_hw_ctx = new_hctxs;
> 2827 q->nr_hw_queues = set->nr_hw_queues;
> 2828 kfree(hctxs);
> 2829 hctxs = new_hctxs;
> 2830 }

Which kernel tree does this syzbot report refer to? Commit
d0930bb8f46b ("blk-mq: Fix a recently introduced regression in
blk_mq_realloc_hw_ctxs()") in Jens' tree removed line 2827 shown above.

Thanks,

Bart.

\
 
 \ /
  Last update: 2020-03-27 03:52    [W:0.087 / U:1.580 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site