From: Tom Van Braeckel <tomvanbraeckel@gmail.com>
To: rusty@rustcorp.com.au, lguest@lists.ozlabs.org
Cc: linux-kernel@vger.kernel.org, fengguang.wu@intel.com,
gregkh@linuxfoundation.org, lkp@01.org,
Tom Van Braeckel <tomvanbraeckel@gmail.com>
Subject: [PATCH] lguest: explicitly setup /dev/lguest private_data
Date: Tue, 7 Apr 2015 10:18:18 +0200 [thread overview]
Message-ID: <1428394698-16938-1-git-send-email-tomvanbraeckel@gmail.com> (raw)
In-Reply-To: <20150406121022.GA3867@wfg-t540p.sh.intel.com>
The private_data member of the /dev/lguest device file is used to hold
the current struct lguest and needs to be set to NULL to signify that
no initialization has taken place.
We explicitly set it to NULL to be independent of whatever value the
misc subsystem initializes it to.
Signed-off-by: Tom Van Braeckel <tomvanbraeckel@gmail.com>
---
Backstory:
==========
The misc subsystem used to initialize a file's private_data to point to
the misc device when a driver had registered a custom open file
operation and initialized it to NULL when a custom open file operation
had *not* been provided.
This subtle quirk was confusing, to the point where kernel code
registered *empty* file open operations to have private_data point to
the misc device structure.
And it lead to bugs, where the addition or removal of a custom open
file operation surprisingly changed the initial contents of a file's
private_data structure.
The misc subsystem is currently underdoing changes to *always* set
private_data to point to the misc device instead of only doing this
when a custom open file operation has been registered.
Intel's 0day kernel testing robot discovered that the lguest driver
depended on it implicitly being initialized to NULL, as Fengguang Wu
reported. Thanks a lot for all the hard work!
drivers/lguest/lguest_user.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/lguest/lguest_user.c b/drivers/lguest/lguest_user.c
index c4c6113..054bf70 100644
--- a/drivers/lguest/lguest_user.c
+++ b/drivers/lguest/lguest_user.c
@@ -98,6 +98,17 @@ static int trap(struct lg_cpu *cpu, const unsigned long __user *input)
return 0;
}
+/*
+ * Set up the /dev/lguest file structure
+ * The file's private_data will hold the "struct lguest" after
+ * initialization and is used to check whether it is already initialized.
+ */
+static int open(struct inode *inode, struct file *file)
+{
+ file->private_data = NULL;
+ return 0;
+}
+
/*L:040
* Once our Guest is initialized, the Launcher makes it run by reading
* from /dev/lguest.
@@ -405,10 +416,11 @@ static int close(struct inode *inode, struct file *file)
*
* We begin our understanding with the Host kernel interface which the Launcher
* uses: reading and writing a character device called /dev/lguest. All the
- * work happens in the read(), write() and close() routines:
+ * work happens in the open(), read(), write() and close() routines:
*/
static const struct file_operations lguest_fops = {
.owner = THIS_MODULE,
+ .open = open,
.release = close,
.write = write,
.read = read,
--
2.1.0
next prev parent reply other threads:[~2015-04-07 8:18 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-04-06 12:10 [miscdevice] BUG: unable to handle kernel NULL pointer dereference at 00000028 Fengguang Wu
2015-04-07 8:18 ` Tom Van Braeckel [this message]
2015-04-07 8:34 ` [PATCH] lguest: explicitly setup /dev/lguest private_data Daniel Baluta
2015-04-07 8:55 ` Greg Kroah-Hartman
2015-04-07 8:36 ` Greg KH
2015-04-10 3:28 ` Rusty Russell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1428394698-16938-1-git-send-email-tomvanbraeckel@gmail.com \
--to=tomvanbraeckel@gmail.com \
--cc=fengguang.wu@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=lguest@lists.ozlabs.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@01.org \
--cc=rusty@rustcorp.com.au \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome