linux-kernel - [PATCH] block: free q->flush_rq in blk_init_allocated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20140320210358.GA14059@kernel.dk>
Date:	Thu, 20 Mar 2014 15:03:58 -0600
From:	Jens Axboe <axboe@...com>
To:	<torvalds@...ux-foundation.org>
CC:	<linux-kernel@...r.kernel.org>
Subject: [PATCH] block: free q->flush_rq in blk_init_allocated_queue error
 paths

Hi Linus,

Turns out there was a potential leak in the error path of the flush
fixup from the last pull, which Dave Jones spotted.

Can you apply this to your current tree before tagging 3.14? Thanks!

From: Dave Jones <davej@...hat.com>

Commit 7982e90c3a ("block: fix q->flush_rq NULL pointer crash on
dm-mpath flush") moved an allocation to blk_init_allocated_queue(),
but neglected to free that allocation on the error paths that
follow.

Signed-off-by: Dave Jones <davej@...oraproject.org>
Acked-by: Mike Snitzer <snitzer@...hat.com>
Signed-off-by: Jens Axboe <axboe@...com>

diff --git a/block/blk-core.c b/block/blk-core.c
index 4cd5ffc18442..bfe16d5af9f9 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -713,7 +713,7 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
 		return NULL;
 
 	if (blk_init_rl(&q->root_rl, q, GFP_KERNEL))
-		return NULL;
+		goto fail;
 
 	q->request_fn		= rfn;
 	q->prep_rq_fn		= NULL;
@@ -737,12 +737,16 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
 	/* init elevator */
 	if (elevator_init(q, NULL)) {
 		mutex_unlock(&q->sysfs_lock);
-		return NULL;
+		goto fail;
 	}
 
 	mutex_unlock(&q->sysfs_lock);
 
 	return q;
+
+fail:
+	kfree(q->flush_rq);
+	return NULL;
 }
 EXPORT_SYMBOL(blk_init_allocated_queue);
 

-- 
Jens Axboe

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/