* [PATCH] block: rnbd-clt: Fix leaked ID in init_dev()
@ 2025-12-16 17:22 Thomas Fourier
2025-12-16 18:02 ` Christophe JAILLET
0 siblings, 1 reply; 2+ messages in thread
From: Thomas Fourier @ 2025-12-16 17:22 UTC (permalink / raw)
Cc: Thomas Fourier, Md. Haris Iqbal, Jack Wang, Jens Axboe,
Lutz Pogrell, Md Haris Iqbal, linux-block, linux-kernel
If kstrdup() fails in init_dev(), then the newly allocated ID is lost.
Fixes: 64e8a6ece1a5 ("block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
drivers/block/rnbd/rnbd-clt.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/block/rnbd/rnbd-clt.c b/drivers/block/rnbd/rnbd-clt.c
index f1409e54010a..d33698eb428d 100644
--- a/drivers/block/rnbd/rnbd-clt.c
+++ b/drivers/block/rnbd/rnbd-clt.c
@@ -1434,7 +1434,7 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
dev->pathname = kstrdup(pathname, GFP_KERNEL);
if (!dev->pathname) {
ret = -ENOMEM;
- goto out_queues;
+ goto out_ida;
}
dev->clt_device_id = ret;
@@ -1453,6 +1453,8 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
return dev;
+out_ida:
+ ida_free(&index_ida, ret);
out_queues:
kfree(dev->hw_queues);
out_alloc:
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] block: rnbd-clt: Fix leaked ID in init_dev()
2025-12-16 17:22 [PATCH] block: rnbd-clt: Fix leaked ID in init_dev() Thomas Fourier
@ 2025-12-16 18:02 ` Christophe JAILLET
0 siblings, 0 replies; 2+ messages in thread
From: Christophe JAILLET @ 2025-12-16 18:02 UTC (permalink / raw)
To: Thomas Fourier
Cc: Md. Haris Iqbal, Jack Wang, Jens Axboe, Lutz Pogrell,
Md Haris Iqbal, linux-block, linux-kernel
Le 16/12/2025 à 18:22, Thomas Fourier a écrit :
> If kstrdup() fails in init_dev(), then the newly allocated ID is lost.
>
> Fixes: 64e8a6ece1a5 ("block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name")
> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
> ---
> drivers/block/rnbd/rnbd-clt.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/block/rnbd/rnbd-clt.c b/drivers/block/rnbd/rnbd-clt.c
> index f1409e54010a..d33698eb428d 100644
> --- a/drivers/block/rnbd/rnbd-clt.c
> +++ b/drivers/block/rnbd/rnbd-clt.c
> @@ -1434,7 +1434,7 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
> dev->pathname = kstrdup(pathname, GFP_KERNEL);
> if (!dev->pathname) {
> ret = -ENOMEM;
^_______ here
> - goto out_queues;
> + goto out_ida;
> }
>
> dev->clt_device_id = ret;
> @@ -1453,6 +1453,8 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
>
> return dev;
>
> +out_ida:
> + ida_free(&index_ida, ret);
This does not work.
'ret' is being re-assigned to -ENOMEM before going there.
But there is definitively a bug to be fixed.
Maybe by assigning clt_device_id earlier and using it in the error
handling path?
CJ
> out_queues:
> kfree(dev->hw_queues);
> out_alloc:
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-12-16 18:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-16 17:22 [PATCH] block: rnbd-clt: Fix leaked ID in init_dev() Thomas Fourier
2025-12-16 18:02 ` Christophe JAILLET
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox