From 1114a7985d8ca1f04210b38a2d90f0e837b4ea05 Mon Sep 17 00:00:00 2001 From: Paolo Valente Date: Wed, 26 Apr 2017 19:14:04 +0200 Subject: [PATCH 1/3] block, bfq: use pointer entity->sched_data only if set In the function __bfq_deactivate_entity, the pointer entity->sched_data could happen to be used before being properly initialized. This led to a NULL pointer dereference. This commit fixes this bug by just using this pointer only where it is safe to do so. Reported-by: Tom Harrison Tested-by: Tom Harrison Signed-off-by: Paolo Valente --- block/bfq-sched.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/block/bfq-sched.c b/block/bfq-sched.c index 70aac56..8311bdb 100644 --- a/block/bfq-sched.c +++ b/block/bfq-sched.c @@ -1280,14 +1280,23 @@ static bool __bfq_deactivate_entity(struct bfq_entity *entity, bool ins_into_idle_tree) { struct bfq_sched_data *sd = entity->sched_data; - struct bfq_service_tree *st = bfq_entity_service_tree(entity); - bool is_in_service = entity == sd->in_service_entity; + struct bfq_service_tree *st; + bool is_in_service; if (!entity->on_st) { /* entity never activated, or already inactive */ - BUG_ON(entity == entity->sched_data->in_service_entity); + BUG_ON(sd && entity == sd->in_service_entity); return false; } + /* + * If we get here, then entity is active, which implies that + * bfq_group_set_parent has already been invoked for the group + * represented by entity. Therefore, the field + * entity->sched_data has been set, and we can safely use it. + */ + st = bfq_entity_service_tree(entity); + is_in_service = entity == sd->in_service_entity; + BUG_ON(is_in_service && entity->tree && entity->tree != &st->active); if (is_in_service) From 614555e901cf87767e339ab4a5e632f938841fe6 Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Thu, 20 Apr 2017 15:07:18 +0100 Subject: [PATCH 2/3] block, bfq: don't dereference bic before null checking it The call to bfq_check_ioprio_change will dereference bic, however, the null check for bic is after this call. Move the the null check on bic to before the call to avoid any potential null pointer dereference issues. Detected by CoverityScan, CID#1430138 ("Dereference before null check") Signed-off-by: Colin Ian King Signed-off-by: Jens Axboe --- block/bfq-iosched.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index 59b1891..77db5a5 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -4561,6 +4561,8 @@ static int bfq_set_request(struct request_queue *q, struct request *rq, if (!bic) goto queue_fail; + bfq_check_ioprio_change(bic, bio); + bfq_bic_update_cgroup(bic, bio); new_queue: From 547022587388ae4e2f27bc45ba23eb040c0558b1 Mon Sep 17 00:00:00 2001 From: Paolo Valente Date: Mon, 1 May 2017 19:15:43 +0200 Subject: [PATCH 3/3] BFQ-v8r11 Signed-off-by: Paolo Valente --- block/bfq-iosched.c | 2 +- block/bfq.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index 77db5a5..6d06c3c 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -5259,7 +5259,7 @@ static struct blkcg_policy blkcg_policy_bfq = { static int __init bfq_init(void) { int ret; - char msg[60] = "BFQ I/O-scheduler: v8r10"; + char msg[60] = "BFQ I/O-scheduler: v8r11"; #ifdef CONFIG_BFQ_GROUP_IOSCHED ret = blkcg_policy_register(&blkcg_policy_bfq); diff --git a/block/bfq.h b/block/bfq.h index 7cb3240..8cd2b6f 100644 --- a/block/bfq.h +++ b/block/bfq.h @@ -1,5 +1,5 @@ /* - * BFQ v8r10 for 4.10.0: data structures and common functions prototypes. + * BFQ v8r11 for 4.10.0: data structures and common functions prototypes. * * Based on ideas and code from CFQ: * Copyright (C) 2003 Jens Axboe