diff options
| author | Mikulas Patocka <mpatocka@redhat.com> | 2026-08-03 23:34:02 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-07 17:18:23 +0200 |
| commit | c3f211b7a277dd404b4e7d23095be964b5b46a27 (patch) | |
| tree | 04f3a013b5e47d1eabf6bfe8e3298aca0c8fbff9 | |
| parent | 120de0ac581bc74680d04c91304467241bb173c9 (diff) | |
| download | linux-stable-c3f211b7a277dd404b4e7d23095be964b5b46a27.tar.gz linux-stable-c3f211b7a277dd404b4e7d23095be964b5b46a27.zip | |
dm-stats: fix a crash if allocation of per-cpu data fails
commit cc87e26d9cce22061dc21e51e11afef29dbbc36a upstream.
If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code
jumps to the "out" label and calls dm_stat_free. dm_stat_free does
"for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram,
s->histogram_alloc_size);", which crashes with NULL pointer dereference
if s->stat_percpu[cpu] is NULL.
This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before
using it.
Reported-by: Junzhe Yu <junzheyu1@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: fd2ed4d25270 ("dm: add statistics support")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/md/dm-stats.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c index dbff4922e068..8019eeb4cc91 100644 --- a/drivers/md/dm-stats.c +++ b/drivers/md/dm-stats.c @@ -178,8 +178,10 @@ static void dm_stat_free(struct rcu_head *head) kfree(s->program_id); kfree(s->aux_data); for_each_possible_cpu(cpu) { - dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size); - dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size); + if (s->stat_percpu[cpu]) { + dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size); + dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size); + } } dm_kvfree(s->stat_shared[0].tmp.histogram, s->histogram_alloc_size); dm_kvfree(s, s->shared_alloc_size); |