nbd: fix null-ptr-dereference while accessing 'nbd->config'
mainline inclusion from mainline-v6.7-rc3 commit c2da049f419417808466c529999170f5c3ef7d3d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8P7B3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c2da049f419417808466c529999170f5c3ef7d3d -------------------------------- Memory reordering may occur in nbd_genl_connect(), causing config_refs to be set to 1 while nbd->config is still empty. Opening nbd at this time will cause null-ptr-dereference. T1 T2 nbd_open nbd_get_config_unlocked nbd_genl_connect nbd_alloc_and_init_config //memory reordered refcount_set(&nbd->config_refs, 1) // 2 nbd->config ->null point nbd->config = config // 1 Fix it by adding smp barrier to guarantee the execution sequence. Signed-off-by:Li Nan <linan122@huawei.com> Reviewed-by:
Josef Bacik <josef@toxicpanda.com> Link: https://lore.kernel.org/r/20231116162316.1740402-4-linan666@huaweicloud.com Signed-off-by:
Jens Axboe <axboe@kernel.dk>
Loading
Please sign in to comment