diff mbox

block/nullb: fix NULL deference

Message ID b70eb4a71a01a72a75f2f1efb1fadc4ef77fc7ff.1503693884.git.shli@fb.com (mailing list archive)
State New, archived
Headers show

Commit Message

Shaohua Li Aug. 25, 2017, 8:46 p.m. UTC
Dan reported this:

The patch 2984c8684f96: "nullb: factor disk parameters" from Aug 14,
2017, leads to the following Smatch complaint:

drivers/block/null_blk.c:1759 null_init_tag_set()
	 error: we previously assumed 'nullb' could be null (see line
1750)

  1755		set->cmd_size	= sizeof(struct nullb_cmd);
  1756		set->flags = BLK_MQ_F_SHOULD_MERGE;
  1757		set->driver_data = NULL;
  1758
  1759		if (nullb->dev->blocking)
                    ^^^^^^^^^^^^^^^^^^^^
And an unchecked dereference.

nullb could be NULL here.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Shaohua Li <shli@fb.com>
---
 drivers/block/null_blk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Jens Axboe Aug. 25, 2017, 8:52 p.m. UTC | #1
On 08/25/2017 02:46 PM, Shaohua Li wrote:
> Dan reported this:
> 
> The patch 2984c8684f96: "nullb: factor disk parameters" from Aug 14,
> 2017, leads to the following Smatch complaint:
> 
> drivers/block/null_blk.c:1759 null_init_tag_set()
> 	 error: we previously assumed 'nullb' could be null (see line
> 1750)
> 
>   1755		set->cmd_size	= sizeof(struct nullb_cmd);
>   1756		set->flags = BLK_MQ_F_SHOULD_MERGE;
>   1757		set->driver_data = NULL;
>   1758
>   1759		if (nullb->dev->blocking)
>                     ^^^^^^^^^^^^^^^^^^^^
> And an unchecked dereference.
> 
> nullb could be NULL here.

Applied, thanks. Fixed up your subject line typo.
diff mbox

Patch

diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 2032360..4d328e3 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -1756,7 +1756,7 @@  static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)
 	set->flags = BLK_MQ_F_SHOULD_MERGE;
 	set->driver_data = NULL;
 
-	if (nullb->dev->blocking)
+	if ((nullb && nullb->dev->blocking) || g_blocking)
 		set->flags |= BLK_MQ_F_BLOCKING;
 
 	return blk_mq_alloc_tag_set(set);