It should be possible to just test for the pointer being NULL in the loop
before calling __free_pages() since the list was allocated with kcalloc().
David
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git 6d39b096627f0a1eb6e14f049d8ae3c93e0290f2
On lunedì 21 marzo 2022 09:24:22 CET David Howells wrote:
> It should be possible to just test for the pointer being NULL in the loop
> before calling __free_pages() since the list was allocated with kcalloc().
>
> David
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git 6d39b096627f0a1eb6e14f049d8ae3c93e0290f2
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/970502.1647851062%40warthog.procyon.org.uk.
>
This way you are doing two test for each iteration of the loop that calls
__free_pages(). One for the index "i" to stay less that an unnecessary
high limit, the other for pages[i] being NULL.
However, since you are the Maintainer, yours are the rules :)
Regards,
Fabio M. De Francesco
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: [email protected]
Tested on:
commit: 6d39b096 watch_queue: Fix NULL dereference in error cl..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git
kernel config: https://syzkaller.appspot.com/x/.config?x=19ca6f72fd444749
dashboard link: https://syzkaller.appspot.com/bug?extid=d55757faa9b80590767b
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
On lunedì 21 marzo 2022 09:24:22 CET David Howells wrote:
> It should be possible to just test for the pointer being NULL in the loop
> before calling __free_pages() since the list was allocated with kcalloc().
>
> David
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git 6d39b096627f0a1eb6e14f049d8ae3c93e0290f2
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/970502.1647851062%40warthog.procyon.org.uk.
>
Hello David,
I had already sent a patch for this problem:
https://lore.kernel.org/lkml/[email protected]/
However, I see that you ignored mine and preferred yours. I would have appreciated
to have your review of my patch or to discuss the pros and cons of yours vs. my
solution and be CC'ed in this thread because I've spent some time on it :)
Best regards,
Fabio M. De Francesco