diff options
| author |  Li Nan <linan122@huawei.com>
| 2023-11-17 00:23:16 +0800 |
|---|---|---|
| committer |  Jens Axboe <axboe@kernel.dk>
| 2023-11-20 10:16:44 -0700 |
| commit | c2da049f419417808466c529999170f5c3ef7d3d (patch) | |
| tree | 995e8ca613b5d08357091eeb6770ed9db542a6b9 /block/blk-pm.c | |
| parent | nbd: factor out a helper to get nbd_config without holding 'config_lock' (diff) | |
| download | linux-c2da049f419417808466c529999170f5c3ef7d3d.tar.gz linux-c2da049f419417808466c529999170f5c3ef7d3d.tar.bz2 linux-c2da049f419417808466c529999170f5c3ef7d3d.zip | |
nbd: fix null-ptr-dereference while accessing 'nbd->config'
Memory reordering may occur in nbd_genl_connect(), causing config_refs
to be set to 1 while nbd->config is still empty. Opening nbd at this
time will cause null-ptr-dereference.
T1 T2
nbd_open
nbd_get_config_unlocked
nbd_genl_connect
nbd_alloc_and_init_config
//memory reordered
refcount_set(&nbd->config_refs, 1) // 2
nbd->config
->null point
nbd->config = config // 1
Fix it by adding smp barrier to guarantee the execution sequence.
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Link: https://lore.kernel.org/r/20231116162316.1740402-4-linan666@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block/blk-pm.c')
0 files changed, 0 insertions, 0 deletions