Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

md: fix double free of mddev->private in autorun_array()

In driver/md/md.c, if the function autorun_array() is called,
the problem of double free may occur.

In function autorun_array(), when the function do_md_run() returns an
error, the function do_md_stop() will be called.

The function do_md_run() called function md_run(), but in function
md_run(), the pointer mddev->private may be freed.

The function do_md_stop() called the function __md_stop(), but in
function __md_stop(), the pointer mddev->private also will be freed
without judging null.

At this time, the pointer mddev->private will be double free, so it
needs to be judged null or not.

Signed-off-by: zhangyue <zhangyue1@kylinos.cn>
Signed-off-by: Song Liu <songliubraving@fb.com>

authored by

zhangyue and committed by
Song Liu
07641b5f 55df1ce0

+2 -1
+2 -1
drivers/md/md.c
··· 6271 6271 spin_lock(&mddev->lock); 6272 6272 mddev->pers = NULL; 6273 6273 spin_unlock(&mddev->lock); 6274 - pers->free(mddev, mddev->private); 6274 + if (mddev->private) 6275 + pers->free(mddev, mddev->private); 6275 6276 mddev->private = NULL; 6276 6277 if (pers->sync_request && mddev->to_remove == NULL) 6277 6278 mddev->to_remove = &md_redundancy_group;