Subject: Re: [PATCH v2] locktorture: Fix NULL pointer when torture_type is
 invalid
To: <paulmck@linux.vnet.ibm.com>, Davidlohr Bueso <dave@stgolabs.net>
References: <1453955159-23216-1-git-send-email-wangkefeng.wang@huawei.com>
 <56AC2421.7020006@huawei.com> <20160131002721.GI6719@linux.vnet.ibm.com>
 <20160131221736.GB16147@linux-uzut.site> <56AEC21A.5010107@huawei.com>
 <20160201030235.GC16147@linux-uzut.site> <56AED0C7.7050505@huawei.com>
 <20160202064635.GH6719@linux.vnet.ibm.com>
 <20160203002331.GA3385@linux-uzut.site>
 <20160302195543.GA12593@linux-uzut.site>
 <20160302211216.GC3577@linux.vnet.ibm.com> <56D79566.7010302@huawei.com>
CC: <linux-kernel@vger.kernel.org>, <peterz@infradead.org>, <mingo@redhat.com>,
        Josh Triplett <josh@joshtriplett.org>,
        "Guohanjun (Hanjun Guo)" <guohanjun@huawei.com>
From: Kefeng Wang <wangkefeng.wang@huawei.com>
Message-ID: <56D7BE33.5010605@huawei.com>
Date: Thu, 3 Mar 2016 12:31:47 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.5.1
MIME-Version: 1.0
In-Reply-To: <56D79566.7010302@huawei.com>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1453
Lines: 60

Hi Davidlohr and Paul,

On 2016/3/3 9:37, Kefeng Wang wrote:
> 
> 
> On 2016/3/3 5:12, Paul E. McKenney wrote:
>> On Wed, Mar 02, 2016 at 11:55:43AM -0800, Davidlohr Bueso wrote:
>>> On Tue, 02 Feb 2016, Davidlohr Bueso wrote:
>>>
>>> I've just hit this issue myself and remembered this thread :)
>>>
>>> Paul, folks, does the below patch look reasonable to you? If so
>>> I can properly resend. thanks.
>>
>> If it works for Kefeng Wang, I would be happy to take it.
> 
> Yes, it works for me, tested on my board.
> 

Even if we merge Davidlohr's patch, I think we still need my v2 patch,
here is a scene,
----------
cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL);
if (cxt.lwsa == NULL) {
	goto unwind;
}

or

cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL);
if (cxt.lrsa == NULL) {
        VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory");
        firsterr = -ENOMEM;
        kfree(cxt.lwsa);
        goto unwind;
}
----------
we will get cxt.lwsa = NULL, and go to cleanup, then in

static void __torture_print_stats(char *page,
                                  struct lock_stress_stats *statp, bool write)
{
        bool fail = 0;
        int i, n_stress;
        long max = 0;
        long min = statp[0].n_lock_acquired;   // here, *we will meet NULL pointer dereference*

}

and my patch v2 solve this issue too, so it is still needed.

Thanks,
Kefeng


> 
>>
>> 							Thanx, Paul
>>
>