| Message ID | 20200901115921.8926-1-linmiaohe@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | block: Fix potential NULL pointer dereference in __bio_crypt_clone() | expand |
On Tue, Sep 01, 2020 at 07:59:21AM -0400, Miaohe Lin wrote: > mempool_alloc() may return NULL if __GFP_DIRECT_RECLAIM is not set in > gfp_mask under memory pressure. So we should check the return value of > mempool_alloc() against NULL before dereference. > > Fixes: a892c8d52c02 ("block: Inline encryption support for blk-mq") > Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> > --- > block/blk-crypto.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/block/blk-crypto.c b/block/blk-crypto.c > index 2d5e60023b08..046aff85cfa3 100644 > --- a/block/blk-crypto.c > +++ b/block/blk-crypto.c > @@ -98,7 +98,8 @@ void __bio_crypt_free_ctx(struct bio *bio) > void __bio_crypt_clone(struct bio *dst, struct bio *src, gfp_t gfp_mask) > { > dst->bi_crypt_context = mempool_alloc(bio_crypt_ctx_pool, gfp_mask); > - *dst->bi_crypt_context = *src->bi_crypt_context; > + if (likely(dst->bi_crypt_context)) > + *dst->bi_crypt_context = *src->bi_crypt_context; > } > EXPORT_SYMBOL_GPL(__bio_crypt_clone); It's intended that __GFP_DIRECT_RECLAIM always be set here. Do you have an example where it isn't set here? Also, if this can indeed happen, then we need to make __bio_crypt_clone() (and bio_crypt_clone()) return a bool (or an error code) to indicate whether it succeeded or failed. We can't just ignore the allocation failure. - Eric
diff --git a/block/blk-crypto.c b/block/blk-crypto.c index 2d5e60023b08..046aff85cfa3 100644 --- a/block/blk-crypto.c +++ b/block/blk-crypto.c @@ -98,7 +98,8 @@ void __bio_crypt_free_ctx(struct bio *bio) void __bio_crypt_clone(struct bio *dst, struct bio *src, gfp_t gfp_mask) { dst->bi_crypt_context = mempool_alloc(bio_crypt_ctx_pool, gfp_mask); - *dst->bi_crypt_context = *src->bi_crypt_context; + if (likely(dst->bi_crypt_context)) + *dst->bi_crypt_context = *src->bi_crypt_context; } EXPORT_SYMBOL_GPL(__bio_crypt_clone);
mempool_alloc() may return NULL if __GFP_DIRECT_RECLAIM is not set in gfp_mask under memory pressure. So we should check the return value of mempool_alloc() against NULL before dereference. Fixes: a892c8d52c02 ("block: Inline encryption support for blk-mq") Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> --- block/blk-crypto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)