Re: [CHECKER] bugs in FreeBSD

From: Matthew Dillon (dillon_at_apollo.backplane.com)
Date: 01/18/04

  • Next message: Scott Long: "Re: [CHECKER] bugs in FreeBSD" 
    Date: Sun, 18 Jan 2004 10:44:57 -0800 (PST)
To: Ruslan Ermilov <ru@freebsd.org>

         These cam_sim_alloc() calls seem to be fairly critical to the operation
         of DPT and friends, why is it even possible for them to return NULL
         in the first place and what would be the effect of a (properly handled)
         NULL return if it did occur at this point?

                                            -Matt
                                            Matthew Dillon
                                            <dillon@backplane.com>

    :> > * Create the device queue for our SIM.
    :> > */
    :> > Start --->
    :> > devq =3D cam_simq_alloc(dpt->max_dccbs);
    :> >=20
    :...
    :> Index: dpt_scsi.c
    :> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
    :=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
    :=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
    :> RCS file: /home/ncvs/src/sys/dev/dpt/dpt_scsi.c,v
    :> retrieving revision 1.45
    :> diff -u -p -r1.45 dpt_scsi.c
    :> --- dpt_scsi.c 24 Aug 2003 17:46:04 -0000 1.45
    :> +++ dpt_scsi.c 18 Jan 2004 15:39:13 -0000
    :> @@ -1553,6 +1553,8 @@ dpt_attach(dpt_softc_t *dpt)
    :> dpt->sims[i] =3D cam_sim_alloc(dpt_action, dpt_poll, "dpt",
    :> dpt, dpt->unit, /*untagged*/2,
    :> /*tagged*/dpt->max_dccbs, devq);
    :> + if (dpt->sims[i] =3D=3D NULL)
    :> + break;
    :> if (xpt_bus_register(dpt->sims[i], i) !=3D CAM_SUCCESS) {
    :> cam_sim_free(dpt->sims[i], /*free_devq*/i =3D=3D 0);
    :> break;
    :> %%%
    :>=20
    :Bah, but with this patch that avoids the NULL pointer dereference
    :we start leaking devq. Attached is a more complete patch, and for
    :dev/irr/irr.c too.
    :
    :
    :Cheers,
    :--=20
    :Ruslan Ermilov
    :FreeBSD committer
    :ru@FreeBSD.org
    :
    :--yLVHuoLXiP9kZBkt
    :Content-Type: text/plain; charset=us-ascii
    :Content-Disposition: attachment; filename=p
    :
    :Index: dpt/dpt_scsi.c
    :===================================================================
    :RCS file: /home/ncvs/src/sys/dev/dpt/dpt_scsi.c,v
    :retrieving revision 1.45
    :diff -u -p -r1.45 dpt_scsi.c
    :--- dpt/dpt_scsi.c 24 Aug 2003 17:46:04 -0000 1.45
    :+++ dpt/dpt_scsi.c 18 Jan 2004 15:51:44 -0000
    :@@ -1553,6 +1553,11 @@ dpt_attach(dpt_softc_t *dpt)
    : dpt->sims[i] = cam_sim_alloc(dpt_action, dpt_poll, "dpt",
    : dpt, dpt->unit, /*untagged*/2,
    : /*tagged*/dpt->max_dccbs, devq);
    :+ if (dpt->sims[i] == NULL) {
    :+ if (i == 0)
    :+ cam_simq_free(devq);
    :+ break;
    :+ }
    : if (xpt_bus_register(dpt->sims[i], i) != CAM_SUCCESS) {
    : cam_sim_free(dpt->sims[i], /*free_devq*/i == 0);
    : break;
    :Index: iir/iir.c
    :===================================================================
    :RCS file: /home/ncvs/src/sys/dev/iir/iir.c,v
    :retrieving revision 1.9
    :diff -u -p -r1.9 iir.c
    :--- iir/iir.c 26 Sep 2003 15:36:47 -0000 1.9
    :+++ iir/iir.c 18 Jan 2004 15:52:04 -0000
    :@@ -510,6 +510,11 @@ iir_attach(struct gdt_softc *gdt)
    : gdt->sims[i] = cam_sim_alloc(iir_action, iir_poll, "iir",
    : gdt, gdt->sc_hanum, /*untagged*/2,
    : /*tagged*/GDT_MAXCMDS, devq);
    :+ if (gdt->sims[i] == NULL) {
    :+ if (i == 0)
    :+ cam_simq_free(devq);
    :+ break;
    :+ }
    : if (xpt_bus_register(gdt->sims[i], i) != CAM_SUCCESS) {
    : cam_sim_free(gdt->sims[i], /*free_devq*/i == 0);
    : break;
    :
    :--yLVHuoLXiP9kZBkt--
    :
    :--SO98HVl1bnMOfKZd
    :Content-Type: application/pgp-signature
    :Content-Disposition: inline
    :
    :-----BEGIN PGP SIGNATURE-----
    :Version: GnuPG v1.2.4 (FreeBSD)
    :
    :iD8DBQFACq9iUkv4P6juNwoRAghWAKCBpqGJmtW1g7vOJS15YgKfg/782QCeImr/
    :aZ5eUYh2kvOaSBl5zcFd4mE=
    :=j+I+
    :-----END PGP SIGNATURE-----

    _______________________________________________
    freebsd-hackers@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
    To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"

  • Next message: Scott Long: "Re: [CHECKER] bugs in FreeBSD"

    Relevant Pages