diff options
| author | Mikulas Patocka <mpatocka@redhat.com> | 2026-08-03 23:34:02 +0200 |
|---|---|---|
| committer | Mikulas Patocka <mpatocka@redhat.com> | 2026-08-04 10:20:10 +0200 |
| commit | cc87e26d9cce22061dc21e51e11afef29dbbc36a (patch) | |
| tree | 4018ab2b09f3fa7686c1add95f9c337a128316de /drivers | |
| parent | 4538a287bdf5d0f9a379c678e5262b9f5783f547 (diff) | |
| download | linux-cc87e26d9cce22061dc21e51e11afef29dbbc36a.tar.gz linux-cc87e26d9cce22061dc21e51e11afef29dbbc36a.zip | |
dm-stats: fix a crash if allocation of per-cpu data fails
If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code
jumps to the "out" label and calls dm_stat_free. dm_stat_free does
"for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram,
s->histogram_alloc_size);", which crashes with NULL pointer dereference
if s->stat_percpu[cpu] is NULL.
This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before
using it.
Reported-by: Junzhe Yu <junzheyu1@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: fd2ed4d25270 ("dm: add statistics support")
Cc: stable@vger.kernel.org
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/md/dm-stats.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c index 5df710061a11..beabbe3b39f3 100644 --- a/drivers/md/dm-stats.c +++ b/drivers/md/dm-stats.c @@ -178,8 +178,10 @@ static void dm_stat_free(struct rcu_head *head) kfree(s->program_id); kfree(s->aux_data); for_each_possible_cpu(cpu) { - dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size); - dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size); + if (s->stat_percpu[cpu]) { + dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size); + dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size); + } } dm_kvfree(s->stat_shared[0].tmp.histogram, s->histogram_alloc_size); dm_kvfree(s, s->shared_alloc_size); |