The result of kmalloc should have been checked ahead of below statement:
pqp = (struct bau_pq_entry *)vp;
Move BUG_ON(!vp) before above statement.
Signed-off-by: Austin Kim <[email protected]>
---
arch/x86/platform/uv/tlb_uv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 20c389a..5f0a96bf 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1804,9 +1804,9 @@ static void pq_init(int node, int pnode)
plsize = (DEST_Q_SIZE + 1) * sizeof(struct bau_pq_entry);
vp = kmalloc_node(plsize, GFP_KERNEL, node);
- pqp = (struct bau_pq_entry *)vp;
- BUG_ON(!pqp);
+ BUG_ON(!vp);
+ pqp = (struct bau_pq_entry *)vp;
cp = (char *)pqp + 31;
pqp = (struct bau_pq_entry *)(((unsigned long)cp >> 5) << 5);
--
2.6.2
On Fri, Sep 06, 2019 at 08:29:51AM +0900, Austin Kim wrote:
> The result of kmalloc should have been checked ahead of below statement:
> pqp = (struct bau_pq_entry *)vp;
>
> Move BUG_ON(!vp) before above statement.
>
> Signed-off-by: Austin Kim <[email protected]>
> ---
> arch/x86/platform/uv/tlb_uv.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
> index 20c389a..5f0a96bf 100644
> --- a/arch/x86/platform/uv/tlb_uv.c
> +++ b/arch/x86/platform/uv/tlb_uv.c
> @@ -1804,9 +1804,9 @@ static void pq_init(int node, int pnode)
>
> plsize = (DEST_Q_SIZE + 1) * sizeof(struct bau_pq_entry);
> vp = kmalloc_node(plsize, GFP_KERNEL, node);
> - pqp = (struct bau_pq_entry *)vp;
> - BUG_ON(!pqp);
> + BUG_ON(!vp);
Ick! Don't crash the whole machine if you are out of memory, that's a
totally lazy and broken driver. Fix this up properly please.
But the original code is just fine (from a this is doing what I want it
to do point of view), I don't see the need to change anything here, you
did not modify any logic at all.
thanks,
greg k-h
On Fri, Sep 06, 2019 at 11:32:52AM +0200, Greg KH wrote:
> On Fri, Sep 06, 2019 at 08:29:51AM +0900, Austin Kim wrote:
> > The result of kmalloc should have been checked ahead of below statement:
> > pqp = (struct bau_pq_entry *)vp;
> >
> > Move BUG_ON(!vp) before above statement.
> >
> > Signed-off-by: Austin Kim <[email protected]>
> > ---
> > arch/x86/platform/uv/tlb_uv.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
> > index 20c389a..5f0a96bf 100644
> > --- a/arch/x86/platform/uv/tlb_uv.c
> > +++ b/arch/x86/platform/uv/tlb_uv.c
> > @@ -1804,9 +1804,9 @@ static void pq_init(int node, int pnode)
> >
> > plsize = (DEST_Q_SIZE + 1) * sizeof(struct bau_pq_entry);
> > vp = kmalloc_node(plsize, GFP_KERNEL, node);
> > - pqp = (struct bau_pq_entry *)vp;
> > - BUG_ON(!pqp);
> > + BUG_ON(!vp);
>
> Ick! Don't crash the whole machine if you are out of memory, that's a
> totally lazy and broken driver. Fix this up properly please.
This is boot time init; if memory allocation fails, we're in trouble, no
way forward no way back.
It is not uncommon to have BUG_ON() for alloc failing during boot.
> But the original code is just fine (from a this is doing what I want it
> to do point of view), I don't see the need to change anything here, you
> did not modify any logic at all.
Agreed, the patch seems entirely pointless.
On Fri, Sep 06, 2019 at 12:43:41PM +0200, Peter Zijlstra wrote:
> On Fri, Sep 06, 2019 at 11:32:52AM +0200, Greg KH wrote:
> > On Fri, Sep 06, 2019 at 08:29:51AM +0900, Austin Kim wrote:
> > > The result of kmalloc should have been checked ahead of below statement:
> > > pqp = (struct bau_pq_entry *)vp;
> > >
> > > Move BUG_ON(!vp) before above statement.
> > >
> > > Signed-off-by: Austin Kim <[email protected]>
> > > ---
> > > arch/x86/platform/uv/tlb_uv.c | 4 ++--
> > > 1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
> > > index 20c389a..5f0a96bf 100644
> > > --- a/arch/x86/platform/uv/tlb_uv.c
> > > +++ b/arch/x86/platform/uv/tlb_uv.c
> > > @@ -1804,9 +1804,9 @@ static void pq_init(int node, int pnode)
> > >
> > > plsize = (DEST_Q_SIZE + 1) * sizeof(struct bau_pq_entry);
> > > vp = kmalloc_node(plsize, GFP_KERNEL, node);
> > > - pqp = (struct bau_pq_entry *)vp;
> > > - BUG_ON(!pqp);
> > > + BUG_ON(!vp);
> >
> > Ick! Don't crash the whole machine if you are out of memory, that's a
> > totally lazy and broken driver. Fix this up properly please.
>
> This is boot time init; if memory allocation fails, we're in trouble, no
> way forward no way back.
>
> It is not uncommon to have BUG_ON() for alloc failing during boot.
Hey, how come you get to get away with this here, and in the tty layer I
had to do all sorts of foolish things just for the same "impossible"
thing because syzbot found a way to emulate such lunacy?
Just you wait until the fuzzers get ahold of this code... :)
greg k-h