Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1628297 > unrolled thread
| Started by | Colin Ian King <colin.king@canonical.com> |
|---|---|
| First post | 2017-04-21 16:10 +0200 |
| Last post | 2017-04-21 21:30 +0200 |
| Articles | 4 — 3 participants |
Back to article view | Back to linux.kernel
re: mtip32xx: add a status field to struct mtip_cmd Colin Ian King <colin.king@canonical.com> - 2017-04-21 16:10 +0200
Re: mtip32xx: add a status field to struct mtip_cmd Jens Axboe <axboe@kernel.dk> - 2017-04-21 16:20 +0200
Re: mtip32xx: add a status field to struct mtip_cmd Christoph Hellwig <hch@lst.de> - 2017-04-21 16:40 +0200
Re: mtip32xx: add a status field to struct mtip_cmd Jens Axboe <axboe@kernel.dk> - 2017-04-21 21:30 +0200
| From | Colin Ian King <colin.king@canonical.com> |
|---|---|
| Date | 2017-04-21 16:10 +0200 |
| Subject | re: mtip32xx: add a status field to struct mtip_cmd |
| Message-ID | <tyHq3-6LU-53@gated-at.bofh.it> |
Hi,
CoverityScan found an issue with the following part of the patch:
- if (likely(!reserv))
- blk_mq_complete_request(rq, -ENODEV);
- else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
+ if (likely(!reserv)) {
+ cmd->status = -ENODEV;
+ blk_mq_complete_request(rq, 0);
+ } else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
The issue is:
static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv)
{
struct driver_data *dd = (struct driver_data *)data;
struct mtip_cmd *cmd;
if (likely(!reserv)) {
cmd->status = -ENODEV;
CID 1430258 (#1 of 1): Uninitialized pointer write (UNINIT)4.
uninit_use: Using uninitialized value cmd.
..basically a null ptr dereference on cmd.
Colin
[toc] | [next] | [standalone]
| From | Jens Axboe <axboe@kernel.dk> |
|---|---|
| Date | 2017-04-21 16:20 +0200 |
| Message-ID | <tyHzJ-6Pl-41@gated-at.bofh.it> |
| In reply to | #1628297 |
On 04/21/2017 08:06 AM, Colin Ian King wrote:
> Hi,
>
> CoverityScan found an issue with the following part of the patch:
>
> - if (likely(!reserv))
> - blk_mq_complete_request(rq, -ENODEV);
> - else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
> + if (likely(!reserv)) {
> + cmd->status = -ENODEV;
> + blk_mq_complete_request(rq, 0);
> + } else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
>
>
From: Jens Axboe <axboe@fb.com>
Subject: [PATCH] mtip32xx: fix dereference of stack garbage
We need to get the command payload from the request before
we attempt to dereference it.
Fixes: 4dda4735c581 ("mtip32xx: add a status field to struct mtip_cmd")
Signed-off-by: Jens Axboe <axboe@fb.com>
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 66a6bd83faae..54c8736038de 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4108,6 +4108,7 @@ static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv)
struct mtip_cmd *cmd;
if (likely(!reserv)) {
+ cmd = blk_mq_rq_to_pdu(rq);
cmd->status = -ENODEV;
blk_mq_complete_request(rq);
} else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
--
Jens Axboe
[toc] | [prev] | [next] | [standalone]
| From | Christoph Hellwig <hch@lst.de> |
|---|---|
| Date | 2017-04-21 16:40 +0200 |
| Message-ID | <tyHT4-6W1-15@gated-at.bofh.it> |
| In reply to | #1628317 |
On Fri, Apr 21, 2017 at 08:14:03AM -0600, Jens Axboe wrote:
> From: Jens Axboe <axboe@fb.com>
> Subject: [PATCH] mtip32xx: fix dereference of stack garbage
>
> We need to get the command payload from the request before
> we attempt to dereference it.
>
> Fixes: 4dda4735c581 ("mtip32xx: add a status field to struct mtip_cmd")
> Signed-off-by: Jens Axboe <axboe@fb.com>
Looks fine:
Reviewed-by: Christoph Hellwig <hch@lst.de>
[toc] | [prev] | [next] | [standalone]
| From | Jens Axboe <axboe@kernel.dk> |
|---|---|
| Date | 2017-04-21 21:30 +0200 |
| Message-ID | <tyMpI-1h4-31@gated-at.bofh.it> |
| In reply to | #1628346 |
On 04/21/2017 08:37 AM, Christoph Hellwig wrote:
> On Fri, Apr 21, 2017 at 08:14:03AM -0600, Jens Axboe wrote:
>> From: Jens Axboe <axboe@fb.com>
>> Subject: [PATCH] mtip32xx: fix dereference of stack garbage
>>
>> We need to get the command payload from the request before
>> we attempt to dereference it.
>>
>> Fixes: 4dda4735c581 ("mtip32xx: add a status field to struct mtip_cmd")
>> Signed-off-by: Jens Axboe <axboe@fb.com>
>
> Looks fine:
>
> Reviewed-by: Christoph Hellwig <hch@lst.de>
Pushed, thanks.
--
Jens Axboe
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web