From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932912AbbCDGSa (ORCPT ); Wed, 4 Mar 2015 01:18:30 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:42994 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759318AbbCDGS1 (ORCPT ); Wed, 4 Mar 2015 01:18:27 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tony Battersby , Jens Axboe Subject: [PATCH 3.18 077/151] blk-mq: fix double-free in error path Date: Tue, 3 Mar 2015 22:13:31 -0800 Message-Id: <20150304055510.144339643@linuxfoundation.org> X-Mailer: git-send-email 2.3.1 In-Reply-To: <20150304055457.084276421@linuxfoundation.org> References: <20150304055457.084276421@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tony Battersby commit 564e559f2baf6a868768d0cac286980b3cfd6e30 upstream. If the allocation of bt->bs fails, then bt->map can be freed twice, once in blk_mq_init_bitmap_tags() -> bt_alloc(), and once in blk_mq_init_bitmap_tags() -> bt_free(). Fix by setting the pointer to NULL after the first free. Signed-off-by: Tony Battersby Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- block/blk-mq-tag.c | 1 + 1 file changed, 1 insertion(+) --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -500,6 +500,7 @@ static int bt_alloc(struct blk_mq_bitmap bt->bs = kzalloc(BT_WAIT_QUEUES * sizeof(*bt->bs), GFP_KERNEL); if (!bt->bs) { kfree(bt->map); + bt->map = NULL; return -ENOMEM; }