Messages in this thread | | | Subject | Re: [axboe-block:for-5.17/block 106/108] block/blk-ioc.c:307 set_task_ioprio() error: we previously assumed 'task->io_context' could be null (see line 300) | From | Eric Dumazet <> | Date | Mon, 20 Dec 2021 18:57:35 -0800 |
| |
On 12/16/21 11:49 PM, Dan Carpenter wrote: > tree: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-5.17/block > head: 5ef1630586317e92c9ebd7b4ce48f393b7ff790f > commit: 5fc11eebb4a98df5324a4de369bb5ab7f0007ff7 [106/108] block: open code create_task_io_context in set_task_ioprio > config: i386-randconfig-m021-20211216 (https://download.01.org/0day-ci/archive/20211217/202112171520.5hNnOM0q-lkp@intel.com/config) > compiler: gcc-9 (Debian 9.3.0-22) 9.3.0 > > If you fix the issue, kindly add following tag as appropriate > Reported-by: kernel test robot <lkp@intel.com> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > > smatch warnings: > block/blk-ioc.c:307 set_task_ioprio() error: we previously assumed 'task->io_context' could be null (see line 300) > > vim +307 block/blk-ioc.c > > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 271 int set_task_ioprio(struct task_struct *task, int ioprio) > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 272 { > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 273 int err; > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 274 const struct cred *cred = current_cred(), *tcred; > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 275 > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 276 rcu_read_lock(); > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 277 tcred = __task_cred(task); > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 278 if (!uid_eq(tcred->uid, cred->euid) && > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 279 !uid_eq(tcred->uid, cred->uid) && !capable(CAP_SYS_NICE)) { > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 280 rcu_read_unlock(); > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 281 return -EPERM; > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 282 } > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 283 rcu_read_unlock(); > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 284 > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 285 err = security_task_setioprio(task, ioprio); > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 286 if (err) > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 287 return err; > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 288 > 8472161b77c41d Christoph Hellwig 2021-12-09 289 task_lock(task); > 8472161b77c41d Christoph Hellwig 2021-12-09 290 if (unlikely(!task->io_context)) { > 8472161b77c41d Christoph Hellwig 2021-12-09 291 struct io_context *ioc; > 8472161b77c41d Christoph Hellwig 2021-12-09 292 > 8472161b77c41d Christoph Hellwig 2021-12-09 293 task_unlock(task); > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 294 > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 295 ioc = alloc_io_context(GFP_ATOMIC, NUMA_NO_NODE); > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 296 if (!ioc) > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 297 return -ENOMEM; > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 298 > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 299 task_lock(task); > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 @300 if (task->io_context || (task->flags & PF_EXITING)) { > ^^^^^^^^^^^^^^^^^^^^^^^^ > Assume "task->io_context" is NULL but PF_EXITING is set. > > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 301 kmem_cache_free(iocontext_cachep, ioc); > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 302 ioc = task->io_context; > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 303 } else { > 5fc11eebb4a98d Christoph Hellwig 2021-12-09 304 task->io_context = ioc; > a411cd3cfdc5bb Christoph Hellwig 2021-12-09 305 } > 8472161b77c41d Christoph Hellwig 2021-12-09 306 } > 8472161b77c41d Christoph Hellwig 2021-12-09 @307 task->io_context->ioprio = ioprio; > ^^^^^^^^^^^^^^^^^^ > Unchecked dereference.
I will release a syzbot report with a repro like this:
syscall(__NR_clone, 0x3a3dd4008400af01ul, 0ul, 0x9999999999999999ul, 0ul, -1ul); syscall(__NR_ioprio_set, 3ul, 0, 0ul);
| |