[PATCH] nvme-core: Fixing ctrl de-referencing in nvme_init_ctrl

Sagi Grimberg sagi at grimberg.me
Mon Apr 3 15:37:45 PDT 2023


> The thing is that after device_initialize is called the reference
> count for the device is equal to 1. Now the function also calls
> nvme_get_ctrl which increases the ref-count to 2.
> However the teardown path only accounts for 1 decrement. This means
> that if an error were to occur during nvme_init_ctrl, we would return
> from nvme_probe without having freed the resources of the controller.

Not arguing the bug, just want to understand what Fixes tag it needs,
so that this can go as far as possible to stable kernels.



More information about the Linux-nvme mailing list