* [PATCH] md: fix the problem that the pointer may be double free
@ 2021-11-16 2:35 zhangyue
2021-11-17 7:23 ` Song Liu
0 siblings, 1 reply; 2+ messages in thread
From: zhangyue @ 2021-11-16 2:35 UTC (permalink / raw)
To: song; +Cc: linux-raid, linux-kernel
int driver/md/md.c, if the function autorun_array() is called,
the problem of double free may occur.
in function autorun_array(), when the function do_md_run() returns an
error, the function do_md_stop() will be called.
The function do_md_run() called function md_run(), but in function
md_run(), the pointer mddev->private may be freed.
The function do_md_stop() called the function __md_stop(), but in
function __md_stop(), the pointer mddev->private also will be freed
without judging null.
At this time, the pointer mddev->private will be double free, so it
needs to be judged null or not.
Signed-off-by: zhangyue <zhangyue1@kylinos.cn>
---
drivers/md/md.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index f16f190546ef..07c9071578d4 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6307,7 +6307,8 @@ static void __md_stop(struct mddev *mddev)
spin_lock(&mddev->lock);
mddev->pers = NULL;
spin_unlock(&mddev->lock);
- pers->free(mddev, mddev->private);
+ if (mddev->private)
+ pers->free(mddev, mddev->private);
mddev->private = NULL;
if (pers->sync_request && mddev->to_remove == NULL)
mddev->to_remove = &md_redundancy_group;
--
2.30.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] md: fix the problem that the pointer may be double free
2021-11-16 2:35 [PATCH] md: fix the problem that the pointer may be double free zhangyue
@ 2021-11-17 7:23 ` Song Liu
0 siblings, 0 replies; 2+ messages in thread
From: Song Liu @ 2021-11-17 7:23 UTC (permalink / raw)
To: zhangyue; +Cc: linux-raid, open list
On Mon, Nov 15, 2021 at 6:37 PM zhangyue <zhangyue1@kylinos.cn> wrote:
>
> int driver/md/md.c, if the function autorun_array() is called,
> the problem of double free may occur.
>
> in function autorun_array(), when the function do_md_run() returns an
> error, the function do_md_stop() will be called.
>
> The function do_md_run() called function md_run(), but in function
> md_run(), the pointer mddev->private may be freed.
>
> The function do_md_stop() called the function __md_stop(), but in
> function __md_stop(), the pointer mddev->private also will be freed
> without judging null.
>
> At this time, the pointer mddev->private will be double free, so it
> needs to be judged null or not.
>
> Signed-off-by: zhangyue <zhangyue1@kylinos.cn>
Applied to md-fixes. Thanks!
Song
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-11-17 7:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-16 2:35 [PATCH] md: fix the problem that the pointer may be double free zhangyue
2021-11-17 7:23 ` Song Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).