Thread (4 messages) 4 messages, 2 authors, 2017-08-25

Re: [bug report] skd: Avoid that module unloading triggers a use-after-free

From: Dan Carpenter <hidden>
Date: 2017-08-24 18:37:24

On Thu, Aug 24, 2017 at 03:04:12PM +0000, Bart Van Assche wrote:
On Thu, 2017-08-24 at 14:04 +0300, Dan Carpenter wrote:
quoted
Hello Bart Van Assche,

This is a semi-automatic email about new static checker warnings.

The patch 7277cc67b391: "skd: Avoid that module unloading triggers a 
use-after-free" from Aug 17, 2017, leads to the following Smatch 
complaint:

drivers/block/skd_main.c:3080 skd_free_disk()
	 error: we previously assumed 'disk' could be null (see line 3074)

drivers/block/skd_main.c
  3073	
  3074		if (disk && (disk->flags & GENHD_FL_UP))
                    ^^^^
Existing code checked for NULL.  The new code shuffles things around.

  3075			del_gendisk(disk);
  3076	
  3077		if (skdev->queue) {
  3078			blk_cleanup_queue(skdev->queue);
  3079			skdev->queue = NULL;
  3080			disk->queue = NULL;
                        ^^^^^^^^^^^
Now we don't check here.

  3081		}
  3082	

regards,
dan carpenter
Hello Dan,

If you have a look at skd_cons_disk() you will see that skdev->queue != NULL
implies that skdev->disk != NULL. So I think the above report is a false
positive.
Oh, yeah.  You're right.  Thanks for taking a look at this.

regards,
dan carpenter
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help