From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964803AbbCDGso (ORCPT ); Wed, 4 Mar 2015 01:48:44 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:43603 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933473AbbCDGUt (ORCPT ); Wed, 4 Mar 2015 01:20:49 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tony Battersby , Jens Axboe Subject: [PATCH 3.19 087/175] blk-mq: fix double-free in error path Date: Tue, 3 Mar 2015 22:14:25 -0800 Message-Id: <20150304061040.697702429@linuxfoundation.org> X-Mailer: git-send-email 2.3.1 In-Reply-To: <20150304061026.134125919@linuxfoundation.org> References: <20150304061026.134125919@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.19-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tony Battersby commit 564e559f2baf6a868768d0cac286980b3cfd6e30 upstream. If the allocation of bt->bs fails, then bt->map can be freed twice, once in blk_mq_init_bitmap_tags() -> bt_alloc(), and once in blk_mq_init_bitmap_tags() -> bt_free(). Fix by setting the pointer to NULL after the first free. Signed-off-by: Tony Battersby Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- block/blk-mq-tag.c | 1 + 1 file changed, 1 insertion(+) --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -509,6 +509,7 @@ static int bt_alloc(struct blk_mq_bitmap bt->bs = kzalloc(BT_WAIT_QUEUES * sizeof(*bt->bs), GFP_KERNEL); if (!bt->bs) { kfree(bt->map); + bt->map = NULL; return -ENOMEM; }