Messages in this thread | | | Subject | Re: [PATCH RESEND] nbd: avoid losing pointer to reallocated config->socks in nbd_add_socket | From | Xiubo Li <> | Date | Sun, 22 Sep 2019 10:38:24 +0800 |
| |
On 2019/9/21 0:06, Eugene Syromiatnikov wrote: > In the (very unlikely) case of config->socks reallocation success > and nsock allocation failure config->nsock will not get updated > with the new pointer to socks array. Fix it by updating config->socks > right after reallocation successfulness check. > > Fixes: 9561a7ade0c2 ("nbd: add multi-connection support") > Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com> > Cc: stable@vger.kernel.org # 4.10+ > --- > drivers/block/nbd.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c > index a8e3815..a04c686 100644 > --- a/drivers/block/nbd.c > +++ b/drivers/block/nbd.c > @@ -987,14 +987,14 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, > sockfd_put(sock); > return -ENOMEM; > } > + config->socks = socks; > + > nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL); > if (!nsock) { > sockfd_put(sock); > return -ENOMEM; > } > > - config->socks = socks; > -
This makes sense.
If the socks allocating successes, then the old config->socks will be freed by krealloc() and return the new one, but if the nsock allocating fails, the config->socks will hold the released memory, which may cause the kernel crash.
Thanks
BRs
> nsock->fallback_index = -1; > nsock->dead = false; > mutex_init(&nsock->tx_lock);
| |