[bug report] drbd: allow parallel promote/demote actions

[bug report] drbd: allow parallel promote/demote actions

[Dan Carpenter]

[ This code is 12 years old.  It's weird to me that no one has complained
about this bug in real life but I suppose that unless you have kfree
poisoning or KASAN enabled then probably you wouldn't notice it. ]

Hello Lars Ellenberg,

Commit 9e276872fe16 ("drbd: allow parallel promote/demote actions")
from Apr 28, 2014 (linux-next), leads to the following Smatch static
checker warning:

drivers/block/drbd/drbd_nl.c:4564 drbd_adm_down() error: dereferencing freed memory 'resource' (line 4562)
drivers/block/drbd/drbd_nl.c:4585 drbd_adm_del_resource() error: dereferencing freed memory 'resource' (line 4584)

drivers/block/drbd/drbd_nl.c
    4552         /* delete volumes */
    4553         idr_for_each_entry(&resource->devices, device, i) {
    4554                 retcode = adm_del_minor(device);
    4555                 if (retcode != NO_ERROR) {
    4556                         /* "can not happen" */
    4557                         drbd_msg_put_info(adm_ctx->reply_skb, "failed to delete volume");
    4558                         goto out;
    4559                 }
    4560         }
    4561 
    4562         retcode = adm_del_resource(resource);
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^
This frees "resource"

    4563 out:
--> 4564         mutex_unlock(&resource->adm_mutex);
                              ^^^^^^^^^
Use after free.

    4565 finish:
    4566         adm_ctx->reply_dh->ret_code = retcode;
    4567         return 0;
    4568 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter