[PATCH] nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()

[Chaitanya Kulkarni]

On 3/5/24 20:51, Shin'ichiro Kawasaki wrote:
> When nvme_identify_ns() fails, it frees the pointer to the struct
> nvme_id_ns before it returns. However, ns_update_nuse() calls kfree()
> for the pointer even when nvme_identify_ns() fails. This results in
> KASAN double-free, which was observed with blktests nvme/045 with
> proposed patches [1] on the kernel v6.8-rc7. Fix the double-free by
> skipping kfree() when nvme_identify_ns() fails.
>
> Link: https://lore.kernel.org/linux-block/20240304161303.19681-1-dwagner@suse.de/ [1]
> Fixes: a1a825ab6a60 ("nvme: add csi, ms and nuse to sysfs")
> Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki at wdc.com>
> ---
>   drivers/nvme/host/sysfs.c | 5 ++---
>   1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
> index f2832f70e7e0..f31674d23397 100644
> --- a/drivers/nvme/host/sysfs.c
> +++ b/drivers/nvme/host/sysfs.c
> @@ -221,13 +221,12 @@ static int ns_update_nuse(struct nvme_ns *ns)
>   
>   	ret = nvme_identify_ns(ns->ctrl, ns->head->ns_id, &id);
>   	if (ret)
> -		goto out_free_id;
> +		goto out;
>   
>   	ns->head->nuse = le64_to_cpu(id->nuse);
> -
> -out_free_id:
>   	kfree(id);
>   
> +out:
>   	return ret;
>   }
>   


instead of adding a label that is only used once, why not just return ?
something like this totally untested :-

diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index d099218e494a..9e12b66c4405 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -221,11 +221,10 @@ static int ns_update_nuse(struct nvme_ns *ns)

         ret = nvme_identify_ns(ns->ctrl, ns->head->ns_id, &id);
         if (ret)
-               goto out_free_id;
+               return ret;

         ns->head->nuse = le64_to_cpu(id->nuse);

-out_free_id:
         kfree(id);

         return ret;


-ck