| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20211116023526.7077-1-zhangyue1@kylinos.cn> Date: Tue, 16 Nov 2021 10:35:26 +0800 From: zhangyue <zhangyue1@...inos.cn> To: song@...nel.org Cc: linux-raid@...r.kernel.org, linux-kernel@...r.kernel.org Subject: [PATCH] md: fix the problem that the pointer may be double free int driver/md/md.c, if the function autorun_array() is called, the problem of double free may occur. in function autorun_array(), when the function do_md_run() returns an error, the function do_md_stop() will be called. The function do_md_run() called function md_run(), but in function md_run(), the pointer mddev->private may be freed. The function do_md_stop() called the function __md_stop(), but in function __md_stop(), the pointer mddev->private also will be freed without judging null. At this time, the pointer mddev->private will be double free, so it needs to be judged null or not. Signed-off-by: zhangyue <zhangyue1@...inos.cn> --- drivers/md/md.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index f16f190546ef..07c9071578d4 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -6307,7 +6307,8 @@ static void __md_stop(struct mddev *mddev) spin_lock(&mddev->lock); mddev->pers = NULL; spin_unlock(&mddev->lock); - pers->free(mddev, mddev->private); + if (mddev->private) + pers->free(mddev, mddev->private); mddev->private = NULL; if (pers->sync_request && mddev->to_remove == NULL) mddev->to_remove = &md_redundancy_group; -- 2.30.0
Powered by blists - more mailing lists