Subject: Re: [PATCH v2] locktorture: Fix NULL pointer when torture_type is
 invalid
To: Davidlohr Bueso <dave@stgolabs.net>
References: <20160131221736.GB16147@linux-uzut.site>
 <56AEC21A.5010107@huawei.com> <20160201030235.GC16147@linux-uzut.site>
 <56AED0C7.7050505@huawei.com> <20160202064635.GH6719@linux.vnet.ibm.com>
 <20160203002331.GA3385@linux-uzut.site>
 <20160302195543.GA12593@linux-uzut.site>
 <20160302211216.GC3577@linux.vnet.ibm.com> <56D79566.7010302@huawei.com>
 <56D7BE33.5010605@huawei.com> <20160303083626.GA10957@linux-uzut.site>
CC: <paulmck@linux.vnet.ibm.com>, <linux-kernel@vger.kernel.org>,
        <peterz@infradead.org>, <mingo@redhat.com>,
        Josh Triplett <josh@joshtriplett.org>,
        "Guohanjun (Hanjun Guo)" <guohanjun@huawei.com>
From: Kefeng Wang <wangkefeng.wang@huawei.com>
Message-ID: <56DCE0D4.1060109@huawei.com>
Date: Mon, 7 Mar 2016 10:00:52 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.5.1
MIME-Version: 1.0
In-Reply-To: <20160303083626.GA10957@linux-uzut.site>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2677
Lines: 76


On 2016/3/3 16:36, Davidlohr Bueso wrote:
> On Thu, 03 Mar 2016, Kefeng Wang wrote:
> 

> 
> The below should take care of both issues, what do you think?
> 
> Thanks,
> Davidlohr
> 
> <8-------------------------------------------------------------------------
> Subject: [PATCH] locktorture: Fix nil pointer dereferencing for cleanup paths
> 
> It has been found that paths that invoke cleanups through
> lock_torture_cleanup() can incur in nil pointer dereferencing
> bugs during the statistics printing phase. This is mainly
> because we should not be calling into statistics before we are
> sure things have been setup correctly.
> 
> Specifically, early checks (and the need for handling this in
> the cleanup call) only include parameter checks and basic
> statistics allocation. Once we start write/read kthreads
> we then consider the test as started. As such, update the func
> in question to check for cxt.lwsa writer stats, if not set,
> we either have a bogus parameter or ENOMEM situation and
> therefore only need to deal with general torture calls.
> 
> Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
> ---
> XXX: while looking at the code, do we need at least a stat_interval > 0
> check before stopping the lock_torture_stats kthread?
> 
>  kernel/locking/locktorture.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c
> index 8ef1919..1942848 100644
> --- a/kernel/locking/locktorture.c
> +++ b/kernel/locking/locktorture.c
> @@ -748,6 +748,15 @@ static void lock_torture_cleanup(void)
>      if (torture_cleanup_begin())
>          return;
>  
> +    /*
> +     * Indicates early cleanup, meaning that the test has not run,
> +     * such as when passing bogus args when loading the module. As
> +     * such, only perform the underlying torture-specific cleanups,
> +     * and avoid anything related to locktorture.
> +     */
> +    if (!cxt.lwsa)
> +        goto end;

Sorry for the late response, the cxt.lrsa should be taken into account too.

> +
>      if (writer_tasks) {
>          for (i = 0; i < cxt.nrealwriters_stress; i++)
>              torture_stop_kthread(lock_torture_writer,
> @@ -776,6 +785,7 @@ static void lock_torture_cleanup(void)
>      else
>          lock_torture_print_module_parms(cxt.cur_ops,
>                          "End of test: SUCCESS");
> +end:
>      torture_cleanup_end();
>  }
>  
> @@ -878,6 +888,7 @@ static int __init lock_torture_init(void)
>              cxt.lrsa[i].n_lock_acquired = 0;
>          }
>      }
> +
>      lock_torture_print_module_parms(cxt.cur_ops, "Start of test");
>  
>      /* Prepare torture context. */