Skip to contentSkip to conversation

blk-mq: fix double-free in error path

PATCH In review Tony Battersby 2 participants 2 messages Feb 11, 2015

Subsystems (2)
SCSI Block layer
lore
Share & tools
lore

Tony Battersby

author
#0 lore raw

PATCH 1/1 blk-mq: fix double-free in error path

If the allocation of bt->bs fails, then bt->map can be freed twice, once in blk_mq_init_bitmap_tags() -> bt_alloc(), and once in blk_mq_init_bitmap_tags() -> bt_free(). Fix by setting the pointer to NULL after the first free.

Cc <[email protected]>
Signed-off-by Tony Battersby <[email protected]>

---

For inclusion in kernel 3.20.

block/blk-mq-tag.c renamed from block/blk-mq-tag.c.orig +1 -0
@@ -509,6 +509,7 @@ static int bt_alloc(struct blk_mq_bitmap
 	bt->bs = kzalloc(BT_WAIT_QUEUES * sizeof(*bt->bs), GFP_KERNEL);
 	if (!bt->bs) {
 		kfree(bt->map);
+		bt->map = NULL;
 		return -ENOMEM;
 	}
maintainer
#1 lore raw
Quoted 14 lines · Tony Battersby

If the allocation of bt->bs fails, then bt->map can be freed twice, once in blk_mq_init_bitmap_tags() -> bt_alloc(), and once in blk_mq_init_bitmap_tags() -> bt_free(). Fix by setting the pointer to NULL after the first free.

Cc <[email protected]>
Signed-off-by Tony Battersby <[email protected]>

---

For inclusion in kernel 3.20.

block/blk-mq-tag.c static int bt_alloc(struct blk_mq_bitmap · line 514

Quoted 6 lines
block/blk-mq-tag.c renamed from block/blk-mq-tag.c.orig +1 -0
@@ -509,6 +509,7 @@ static int bt_alloc(struct blk_mq_bitmap
  	bt->bs = kzalloc(BT_WAIT_QUEUES * sizeof(*bt->bs), GFP_KERNEL);
  	if (!bt->bs) {
  		kfree(bt->map);
+		bt->map = NULL;
  		return -ENOMEM;
  	}

Thanks Tony, applied.

Signature · 1 line
Jens Axboe