Messages in this thread | | | Date | Sun, 4 Mar 2012 13:29:19 +0100 | Subject | Re: [PATCH] cfq: fix NULL pointer dereference in cfq_choose_cfqg. | From | richard -rw- weinberger <> |
| |
On Sun, Mar 4, 2012 at 1:10 PM, Namjae Jeon <linkinjeon@gmail.com> wrote: > I found null pointer dereferencing possibility while reviewing. > If cfq_get_next_cfqg return null by RB_EMPTY_ROOT, null pointer dereferencing error can occur. > > Signed-off-by: Namjae Jeon <linkinjeon@gmail.com> > --- > block/cfq-iosched.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c > index d0ba505..d924272 100644 > --- a/block/cfq-iosched.c > +++ b/block/cfq-iosched.c > @@ -2306,7 +2306,7 @@ static void cfq_choose_cfqg(struct cfq_data *cfqd) > cfqd->serving_group = cfqg; > > /* Restore the workload type data */ > - if (cfqg->saved_workload_slice) { > + if (!cfqg && cfqg->saved_workload_slice) { > cfqd->workload_expires = jiffies + cfqg->saved_workload_slice; > cfqd->serving_type = cfqg->saved_workload; > cfqd->serving_prio = cfqg->saved_serving_prio;
I don't think that this is a correct fix.
1. Can it really happen that cfq_get_next_cfqg() returns NULL at this point?
2. Adding a if(!cfgg ...) does not solve the problem, it ignores it. After the if block we call choose_service_tree(). I'm sure choose_service_tree() it not happy when we pass a NULL pointer to it...
-- Thanks, //richard -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |