[PATCH v2] nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()

Chaitanya Kulkarni chaitanyak at nvidia.com
Tue Mar 5 22:30:24 PST 2024


On 3/5/24 22:03, Shin'ichiro Kawasaki wrote:
> When nvme_identify_ns() fails, it frees the pointer to the struct
> nvme_id_ns before it returns. However, ns_update_nuse() calls kfree()
> for the pointer even when nvme_identify_ns() fails. This results in
> KASAN double-free, which was observed with blktests nvme/045 with
> proposed patches [1] on the kernel v6.8-rc7. Fix the double-free by
> skipping kfree() when nvme_identify_ns() fails.
>
> Link: https://lore.kernel.org/linux-block/20240304161303.19681-1-dwagner@suse.de/ [1]
> Fixes: a1a825ab6a60 ("nvme: add csi, ms and nuse to sysfs")
> Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki at wdc.com>
> ---
>

Looks good.

Reviewed-by: Chaitanya Kulkarni <kch at nvidia.com>

-ck




More information about the Linux-nvme mailing list