Messages in this thread | | | Date | Wed, 17 Oct 2012 09:02:22 +0900 | From | "Jun'ichi Nomura" <> | Subject | Re: [PATCH] Fix use-after-free of q->root_blkg and q->root_rl.blkg |
| |
On 10/17/12 08:20, Tejun Heo wrote: >>>> - if (ent == &q->root_blkg->q_node) >>>> + if (q->root_blkg && ent == &q->root_blkg->q_node) >>> >>> Can we fix it little differently. Little earlier in the code, we check for >>> if q->blkg_list is empty, then all the groups are gone, and there are >>> no more request lists hence and return NULL. >>> >>> Current code: >>> if (rl == &q->root_rl) { >>> ent = &q->blkg_list; >>> >>> Modified code: >>> if (rl == &q->root_rl) { >>> ent = &q->blkg_list; >>> /* There are no more block groups, hence no request lists */ >>> if (list_empty(ent)) >>> return NULL; >>> } > > Do we need this at all? q->root_blkg being NULL is completely fine > there and the comparison would work as expected, no?
Hmm?
If list_empty(ent) and q->root_blkg == NULL,
> /* walk to the next list_head, skip root blkcg */ > ent = ent->next;
ent is &q->blkg_list again.
> if (ent == &q->root_blkg->q_node)
So ent is not &q->root_blkg->q_node.
> ent = ent->next; > if (ent == &q->blkg_list) > return NULL;
And we return NULL here.
Ah, yes. You are correct. We can do without the above hunk.
-- Jun'ichi Nomura, NEC Corporation
| |