Felipe Pena
2013-Nov-09 15:36 UTC
[PATCH] block: xen-blkfront: Fix possible NULL ptr dereference
In the blkif_release function the bdget_disk() call might returns a NULL ptr which might be dereferenced on bdev->bd_openers checking Signed-off-by: Felipe Pena <felipensp@gmail.com> --- drivers/block/xen-blkfront.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c index a4660bb..7bb1552 100644 --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -1959,6 +1959,9 @@ static void blkif_release(struct gendisk *disk, fmode_t mode) bdev = bdget_disk(disk, 0); + if (!bdev) + goto out_mutex; + if (bdev->bd_openers) goto out; @@ -1989,6 +1992,7 @@ static void blkif_release(struct gendisk *disk, fmode_t mode) out: bdput(bdev); +out_mutex: mutex_unlock(&blkfront_mutex); } -- 1.7.10.4
Roger Pau Monné
2013-Nov-11 09:48 UTC
Re: [PATCH] block: xen-blkfront: Fix possible NULL ptr dereference
On 09/11/13 16:36, Felipe Pena wrote:> In the blkif_release function the bdget_disk() call might returns > a NULL ptr which might be dereferenced on bdev->bd_openers checking > > Signed-off-by: Felipe Pena <felipensp@gmail.com> > --- > drivers/block/xen-blkfront.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c > index a4660bb..7bb1552 100644 > --- a/drivers/block/xen-blkfront.c > +++ b/drivers/block/xen-blkfront.c > @@ -1959,6 +1959,9 @@ static void blkif_release(struct gendisk *disk, fmode_t mode) > > bdev = bdget_disk(disk, 0); > > + if (!bdev) > + goto out_mutex;Is this actually possible? By looking at blkfront code, it seems like we don''t remove the device if it is still open, so maybe this should be a BUG_ON instead of failing silently. Roger.