summaryrefslogtreecommitdiff
path: root/drivers/md
diff options
context:
space:
mode:
authorzhangyue <zhangyue1@kylinos.cn>2021-11-16 05:35:26 +0300
committerSong Liu <song@kernel.org>2021-12-10 20:11:07 +0300
commit07641b5f32f6991758b08da9b1f4173feeb64f2a (patch)
tree917fff6c999b47fd78b661b151e491da7851ed00 /drivers/md
parent55df1ce0d4e086e05a8ab20619c73c729350f965 (diff)
downloadlinux-07641b5f32f6991758b08da9b1f4173feeb64f2a.tar.xz
md: fix double free of mddev->private in autorun_array()
In driver/md/md.c, if the function autorun_array() is called, the problem of double free may occur. In function autorun_array(), when the function do_md_run() returns an error, the function do_md_stop() will be called. The function do_md_run() called function md_run(), but in function md_run(), the pointer mddev->private may be freed. The function do_md_stop() called the function __md_stop(), but in function __md_stop(), the pointer mddev->private also will be freed without judging null. At this time, the pointer mddev->private will be double free, so it needs to be judged null or not. Signed-off-by: zhangyue <zhangyue1@kylinos.cn> Signed-off-by: Song Liu <songliubraving@fb.com>
Diffstat (limited to 'drivers/md')
-rw-r--r--drivers/md/md.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/md/md.c b/drivers/md/md.c
index e97d2faf1e88..41d6e2383517 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6271,7 +6271,8 @@ static void __md_stop(struct mddev *mddev)
spin_lock(&mddev->lock);
mddev->pers = NULL;
spin_unlock(&mddev->lock);
- pers->free(mddev, mddev->private);
+ if (mddev->private)
+ pers->free(mddev, mddev->private);
mddev->private = NULL;
if (pers->sync_request && mddev->to_remove == NULL)
mddev->to_remove = &md_redundancy_group;