diff mbox

[v2,4/6] pktcdvd: Check queue type before attaching to a queue

Message ID 1514681596.11082.1.camel@wdc.com (mailing list archive)
State New, archived
Headers show

Commit Message

Bart Van Assche Dec. 31, 2017, 12:53 a.m. UTC 
On Sat, 2017-12-30 at 22:41 +0100, Maciej S. Szmigiero wrote:
> This commit causes a NULL pointer dereference when adding a pktcdvd
> mapping.
> 
> Reproducing it is simple:
> # pktsetup 1 /dev/cdrom 
> 
> Specifically, the NULL dereference happens inside bdev_get_queue(bdev),
> which is supposed to return bdev->bd_disk->queue, but in this case
> bdev->bd_disk is NULL.

Would it be possible to test the two attached patches?

Thanks,

Bart.

Comments

Maciej S. Szmigiero Dec. 31, 2017, 1:23 a.m. UTC | #1 
On 31.12.2017 01:53, Bart Van Assche wrote:
> On Sat, 2017-12-30 at 22:41 +0100, Maciej S. Szmigiero wrote:
>> This commit causes a NULL pointer dereference when adding a pktcdvd
>> mapping.
>>
>> Reproducing it is simple:
>> # pktsetup 1 /dev/cdrom 
>>
>> Specifically, the NULL dereference happens inside bdev_get_queue(bdev),
>> which is supposed to return bdev->bd_disk->queue, but in this case
>> bdev->bd_disk is NULL.
> 
> Would it be possible to test the two attached patches?

I've tested 4.14.10 with both applied and can confirm that the NULL
pointer dereference when adding a pktcdvd mapping no longer happens
then.

> Thanks,
> 
> Bart.
> 

Thanks,
Maciej
diff mbox

Patch

From 3192cc5f62b3ba9f866bcb245d21231a39745d8d Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bart.vanassche@wdc.com>
Date: Sat, 30 Dec 2017 16:44:35 -0800
Subject: [PATCH 2/2] pktcdvd: Fix pkt_setup_dev() error path

Since disk_release(disk) calls blk_put_queue() if disk->queue != NULL,
clear disk->queue before calling put_disk().

Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Cc: <stable@vger.kernel.org>
---
 drivers/block/pktcdvd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index fc8a80ec90e5..c5e930d23a63 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -2765,6 +2765,7 @@  static int pkt_setup_dev(dev_t dev, dev_t* pkt_dev)
 
 out_new_dev:
 	blk_cleanup_queue(disk->queue);
+	disk->queue = NULL;
 out_mem2:
 	put_disk(disk);
 out_mem:
-- 
2.15.1