Container_of considered harmful - was Re: usb storage sddr09

Andries Brouwer (aebr@win.tue.nl)
Sun, 20 Oct 2002 20:24:36 +0200


> Both of these are fixed with 2.4.44

Yes, there is progress. Not to say that there are no oopses left,
but with 2.5.44 the oopses are different.

Let me just report one, don't know whether I'll have time to track
what happens.

Insert and remove a usb-storage device while usb-storage
is not loaded. Now load usb-storage. Oops.

The oops is a dereference of fffffff0 in base/bus.c:driver_attach().
I have seen several such oopses lately, various places in the kernel.
The cause here is a NULL pointer that is turned into fffffff0 by
container_of() and then fed to get_device(). And get_device() tests
that it gets a non-NULL pointer, but that does not protect against
fffffff0.

Andries
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/