Commit ea8f1240 authored Jul 08, 2024 by Damien Le Moal Committed by Li Nan Jul 08, 2024

null_blk: Fix return value of nullb_device_power_store()

mainline inclusion
from mainline-v6.10-rc2
commit d9ff882b54f99f96787fa3df7cd938966843c418
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D6H
CVE: CVE-2024-36478

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d9ff882b54f99f96787fa3df7cd938966843c418



--------------------------------

When powering on a null_blk device that is not already on, the return
value ret that is initialized to be count is reused to check the return
value of null_add_dev(), leading to nullb_device_power_store() to return
null_add_dev() return value (0 on success) instead of "count".
So make sure to set ret to be equal to count when there are no errors.

Fixes: a2db328b0839 ("null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'")
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Link: https://lore.kernel.org/r/20240527043445.235267-1-dlemoal@kernel.org


Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Li Nan <linan122@huawei.com>

parent c74fcb9c

drivers/block/null_blk/main.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -470,6 +470,7 @@ static ssize_t nullb_device_power_store(struct config_item *item,

		set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
		dev->power = newp;
		ret = count;
		} else if (dev->power && !newp) {
		if (test_and_clear_bit(NULLB_DEV_FL_UP, &dev->flags)) {
		dev->power = newp;