md: fix double free of mddev->private in autorun_array()
mainline inclusion from mainline-v5.16-rc5 commit 07641b5f category: bugfix bugzilla: 188015, https://gitee.com/openeuler/kernel/issues/I6OERX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=07641b5f32f6991758b08da9b1f4173feeb64f2a -------------------------------- In driver/md/md.c, if the function autorun_array() is called, the problem of double free may occur. In function autorun_array(), when the function do_md_run() returns an error, the function do_md_stop() will be called. The function do_md_run() called function md_run(), but in function md_run(), the pointer mddev->private may be freed. The function do_md_stop() called the function __md_stop(), but in function __md_stop(), the pointer mddev->private also will be freed without judging null. At this time, the pointer mddev->private will be double free, so it needs to be judged null or not. Signed-off-by:zhangyue <zhangyue1@kylinos.cn> Signed-off-by:
Song Liu <songliubraving@fb.com> Signed-off-by:
Li Nan <linan122@huawei.com> Reviewed-by:
Hou Tao <houtao1@huawei.com> Signed-off-by:
Yongqiang Liu <liuyongqiang13@huawei.com>
Loading
Please sign in to comment