* [PATCH] nvme-multipath: zero out ANA log buffer
@ 2019-01-08 11:46 Hannes Reinecke
2019-01-08 16:22 ` Ewan D. Milne
2019-01-09 18:50 ` Christoph Hellwig
0 siblings, 2 replies; 3+ messages in thread
From: Hannes Reinecke @ 2019-01-08 11:46 UTC (permalink / raw)
When nvme_init_identify() fails the ANA log buffer is deallocated
but _not_ set to NULL. This can cause double free oops when this
controller is deleted without ever being reconnected.
Signed-off-by: Hannes Reinecke <hare at suse.com>
---
drivers/nvme/host/multipath.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 183ec17ba067..df4b3a6db51b 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -570,6 +570,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
return 0;
out_free_ana_log_buf:
kfree(ctrl->ana_log_buf);
+ ctrl->ana_log_buf = NULL;
out:
return error;
}
@@ -577,5 +578,6 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
{
kfree(ctrl->ana_log_buf);
+ ctrl->ana_log_buf = NULL;
}
--
2.16.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH] nvme-multipath: zero out ANA log buffer
2019-01-08 11:46 [PATCH] nvme-multipath: zero out ANA log buffer Hannes Reinecke
@ 2019-01-08 16:22 ` Ewan D. Milne
2019-01-09 18:50 ` Christoph Hellwig
1 sibling, 0 replies; 3+ messages in thread
From: Ewan D. Milne @ 2019-01-08 16:22 UTC (permalink / raw)
On Tue, 2019-01-08@12:46 +0100, Hannes Reinecke wrote:
> When nvme_init_identify() fails the ANA log buffer is deallocated
> but _not_ set to NULL. This can cause double free oops when this
> controller is deleted without ever being reconnected.
>
> Signed-off-by: Hannes Reinecke <hare at suse.com>
> ---
> drivers/nvme/host/multipath.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
> index 183ec17ba067..df4b3a6db51b 100644
> --- a/drivers/nvme/host/multipath.c
> +++ b/drivers/nvme/host/multipath.c
> @@ -570,6 +570,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
> return 0;
> out_free_ana_log_buf:
> kfree(ctrl->ana_log_buf);
> + ctrl->ana_log_buf = NULL;
> out:
> return error;
> }
> @@ -577,5 +578,6 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
> void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
> {
> kfree(ctrl->ana_log_buf);
> + ctrl->ana_log_buf = NULL;
> }
>
Reviewed-by: Ewan D. Milne <emilne at redhat.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] nvme-multipath: zero out ANA log buffer
2019-01-08 11:46 [PATCH] nvme-multipath: zero out ANA log buffer Hannes Reinecke
2019-01-08 16:22 ` Ewan D. Milne
@ 2019-01-09 18:50 ` Christoph Hellwig
1 sibling, 0 replies; 3+ messages in thread
From: Christoph Hellwig @ 2019-01-09 18:50 UTC (permalink / raw)
Thanks,
applied to nvme-4.21.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-01-09 18:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-01-08 11:46 [PATCH] nvme-multipath: zero out ANA log buffer Hannes Reinecke
2019-01-08 16:22 ` Ewan D. Milne
2019-01-09 18:50 ` Christoph Hellwig
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox