[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [PATCH RESEND] nbd: avoid losing pointer to reallocated config->socks in nbd_add_socket

On 2019/9/21 0:06, Eugene Syromiatnikov wrote:
In the (very unlikely) case of config->socks reallocation success
and nsock allocation failure config->nsock will not get updated
with the new pointer to socks array. Fix it by updating config->socks
right after reallocation successfulness check.

Fixes: 9561a7ade0c2 ("nbd: add multi-connection support")
Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com>
Cc: stable@vger.kernel.org # 4.10+
  drivers/block/nbd.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index a8e3815..a04c686 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -987,14 +987,14 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
  		return -ENOMEM;
+	config->socks = socks;
  	nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL);
  	if (!nsock) {
  		return -ENOMEM;
- config->socks = socks;

This makes sense.

If the socks allocating successes, then the old config->socks will be freed by krealloc() and return the new one, but if the nsock allocating fails, the config->socks will hold the released memory, which may cause the kernel crash.



  	nsock->fallback_index = -1;
  	nsock->dead = false;

Reply to: