* [PATCH] drivers/block/null_blk/main: Fix a double free in null_init.
@ 2021-04-26 14:32 Lv Yunlong
2021-04-26 15:05 ` Jens Axboe
0 siblings, 1 reply; 2+ messages in thread
From: Lv Yunlong @ 2021-04-26 14:32 UTC (permalink / raw)
To: axboe, damien.lemoal, johannes.thumshirn, martin.petersen
Cc: linux-block, linux-kernel, Lv Yunlong
In null_init, null_add_dev(dev) is called.
In null_add_dev, it calls null_free_zoned_dev(dev) to free dev->zones
via kvfree(dev->zones) in out_cleanup_zone branch and returns err.
Then null_init accept the err code and then calls null_free_dev(dev).
But in null_free_dev(dev), dev->zones is freed again by
null_free_zoned_dev().
My patch set dev->zones to NULL in null_free_zoned_dev() after
kvfree(dev->zones) is called, to avoid the double free.
Fixes: 2984c8684f962 ("nullb: factor disk parameters")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
drivers/block/null_blk/zoned.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/block/null_blk/zoned.c b/drivers/block/null_blk/zoned.c
index bfcab1c782b5..dae54dd1aeac 100644
--- a/drivers/block/null_blk/zoned.c
+++ b/drivers/block/null_blk/zoned.c
@@ -180,6 +180,7 @@ int null_register_zoned_dev(struct nullb *nullb)
void null_free_zoned_dev(struct nullb_device *dev)
{
kvfree(dev->zones);
+ dev->zones = NULL;
}
int null_report_zones(struct gendisk *disk, sector_t sector,
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drivers/block/null_blk/main: Fix a double free in null_init.
2021-04-26 14:32 [PATCH] drivers/block/null_blk/main: Fix a double free in null_init Lv Yunlong
@ 2021-04-26 15:05 ` Jens Axboe
0 siblings, 0 replies; 2+ messages in thread
From: Jens Axboe @ 2021-04-26 15:05 UTC (permalink / raw)
To: Lv Yunlong, damien.lemoal, johannes.thumshirn, martin.petersen
Cc: linux-block, linux-kernel
On 4/26/21 8:32 AM, Lv Yunlong wrote:
> In null_init, null_add_dev(dev) is called.
> In null_add_dev, it calls null_free_zoned_dev(dev) to free dev->zones
> via kvfree(dev->zones) in out_cleanup_zone branch and returns err.
> Then null_init accept the err code and then calls null_free_dev(dev).
>
> But in null_free_dev(dev), dev->zones is freed again by
> null_free_zoned_dev().
>
> My patch set dev->zones to NULL in null_free_zoned_dev() after
> kvfree(dev->zones) is called, to avoid the double free.
Applied, thanks.
--
Jens Axboe
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-04-26 15:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-26 14:32 [PATCH] drivers/block/null_blk/main: Fix a double free in null_init Lv Yunlong
2021-04-26 15:05 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).