Skip to content

Commit f8e9ec1

Browse files
gthelenaxboe
authored andcommitted
block: tolerate tracing of NULL bio
__get_request() can call trace_block_getrq() with bio=NULL which causes block_get_rq::TP_fast_assign() to deref a NULL pointer and panic. Syzkaller fuzzer panics with linux-next (1d53d90): kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Modules linked in: CPU: 0 PID: 2983 Comm: syzkaller401111 Not tainted 4.13.0-rc7-next-20170901+ torvalds#13 task: ffff8801cf1da000 task.stack: ffff8801ce440000 RIP: 0010:perf_trace_block_get_rq+0x697/0x970 include/trace/events/block.h:384 RSP: 0018:ffff8801ce4473f0 EFLAGS: 00010246 RAX: ffff8801cf1da000 RBX: 1ffff10039c88e84 RCX: 1ffffd1ffff84d27 RDX: dffffc0000000001 RSI: 1ffff1003b643e7a RDI: ffffe8ffffc26938 RBP: ffff8801ce447530 R08: 1ffff1003b643e6c R09: ffffe8ffffc26964 R10: 0000000000000002 R11: fffff91ffff84d2d R12: ffffe8ffffc1f890 R13: ffffe8ffffc26930 R14: ffffffff85cad9e0 R15: 0000000000000000 FS: 0000000002641880(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000043e670 CR3: 00000001d1d7a000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: trace_block_getrq include/trace/events/block.h:423 [inline] __get_request block/blk-core.c:1283 [inline] get_request+0x1518/0x23b0 block/blk-core.c:1355 blk_old_get_request block/blk-core.c:1402 [inline] blk_get_request+0x1d8/0x3c0 block/blk-core.c:1427 sg_scsi_ioctl+0x117/0x750 block/scsi_ioctl.c:451 sg_ioctl+0x192d/0x2ed0 drivers/scsi/sg.c:1070 vfs_ioctl fs/ioctl.c:45 [inline] do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685 SYSC_ioctl fs/ioctl.c:700 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691 entry_SYSCALL_64_fastpath+0x1f/0xbe block_get_rq::TP_fast_assign() has multiple redundant ->dev assignments. Only one of them is NULL tolerant. Favor the NULL tolerant one. Fixes: 74d4699 ("block: replace bi_bdev with a gendisk pointer and partitions index") Reviewed-by: Ming Lei <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Greg Thelen <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
1 parent f007cad commit f8e9ec1

File tree

1 file changed

+2
-3
lines changed

1 file changed

+2
-3
lines changed

include/trace/events/block.h

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -397,7 +397,6 @@ DECLARE_EVENT_CLASS(block_get_rq,
397397

398398
TP_fast_assign(
399399
__entry->dev = bio ? bio_dev(bio) : 0;
400-
__entry->dev = bio_dev(bio);
401400
__entry->sector = bio ? bio->bi_iter.bi_sector : 0;
402401
__entry->nr_sector = bio ? bio_sectors(bio) : 0;
403402
blk_fill_rwbs(__entry->rwbs,
@@ -414,7 +413,7 @@ DECLARE_EVENT_CLASS(block_get_rq,
414413
/**
415414
* block_getrq - get a free request entry in queue for block IO operations
416415
* @q: queue for operations
417-
* @bio: pending block IO operation
416+
* @bio: pending block IO operation (can be %NULL)
418417
* @rw: low bit indicates a read (%0) or a write (%1)
419418
*
420419
* A request struct for queue @q has been allocated to handle the
@@ -430,7 +429,7 @@ DEFINE_EVENT(block_get_rq, block_getrq,
430429
/**
431430
* block_sleeprq - waiting to get a free request entry in queue for block IO operation
432431
* @q: queue for operation
433-
* @bio: pending block IO operation
432+
* @bio: pending block IO operation (can be %NULL)
434433
* @rw: low bit indicates a read (%0) or a write (%1)
435434
*
436435
* In the case where a request struct cannot be provided for queue @q

0 commit comments

Comments
 (0)