Messages in this thread | | | Date | Thu, 21 Sep 2023 12:21:02 +0200 | From | Benjamin Block <> | Subject | Re: [PATCH] scsi: zfcp: Fix a potential double free in zfcp_port_enqueue |
| |
Hello Liu Dinghao,
good find.
On Thu, Sep 21, 2023 at 02:39:15PM +0800, Dinghao Liu wrote: > When device_register() fails, zfcp_port_release() will be called > after put_device(). As a result, the zfcp_ccw_adapter_put() after > err_out is redundant because it will be called in the call-back > function zfcp_port_release(). Remove it from this error path.
So the reference on the adapter object is doubly put, which may lead to a premature free of the adapter object itself. Please mention that either in the subject, or description; it makes it easier to see what exactly breaks at a glance.
> > Fixes: f3450c7b9172 ("[SCSI] zfcp: Replace local reference counting with common kref") > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> > --- > drivers/s390/scsi/zfcp_aux.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c > index df782646e856..489e6239dedf 100644 > --- a/drivers/s390/scsi/zfcp_aux.c > +++ b/drivers/s390/scsi/zfcp_aux.c > @@ -552,7 +552,7 @@ struct zfcp_port *zfcp_port_enqueue(struct zfcp_adapter *adapter, u64 wwpn, > > if (device_register(&port->dev)) { > put_device(&port->dev); > - goto err_out; > + return ERR_PTR(retval);
I'd rather have a new label at the bottom, in front of the return that is already there, and jump to that, instead of a different function exit point.
> } > > write_lock_irq(&adapter->port_list_lock); > -- > 2.17.1 >
-- Best Regards, Benjamin Block / Linux on IBM Z Kernel Development IBM Deutschland Research & Development GmbH / https://www.ibm.com/privacy Vors. Aufs.-R.: Gregor Pillen / Geschäftsführung: David Faller Sitz der Ges.: Böblingen / Registergericht: AmtsG Stuttgart, HRB 243294
| |