kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/nvme/host
History
Logan Gunthorpe ea7f30c453 nvme-multipath: Fix memory leak with ana_log_buf 
commit 3b7830904e upstream.

kmemleak reports a memory leak with the ana_log_buf allocated by
nvme_mpath_init():

unreferenced object 0xffff888120e94000 (size 8208):
  comm "nvme", pid 6884, jiffies 4295020435 (age 78786.312s)
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
      01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace:
      [<00000000e2360188>] kmalloc_order+0x97/0xc0
      [<0000000079b18dd4>] kmalloc_order_trace+0x24/0x100
      [<00000000f50c0406>] __kmalloc+0x24c/0x2d0
      [<00000000f31a10b9>] nvme_mpath_init+0x23c/0x2b0
      [<000000005802589e>] nvme_init_identify+0x75f/0x1600
      [<0000000058ef911b>] nvme_loop_configure_admin_queue+0x26d/0x280
      [<00000000673774b9>] nvme_loop_create_ctrl+0x2a7/0x710
      [<00000000f1c7a233>] nvmf_dev_write+0xc66/0x10b9
      [<000000004199f8d0>] __vfs_write+0x50/0xa0
      [<0000000065466fef>] vfs_write+0xf3/0x280
      [<00000000b0db9a8b>] ksys_write+0xc6/0x160
      [<0000000082156b91>] __x64_sys_write+0x43/0x50
      [<00000000c34fbb6d>] do_syscall_64+0x77/0x2f0
      [<00000000bbc574c9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe

nvme_mpath_init() is called by nvme_init_identify() which is called in
multiple places (nvme_reset_work(), nvme_passthru_end(), etc). This
means nvme_mpath_init() may be called multiple times before
nvme_mpath_uninit() (which is only called on nvme_free_ctrl()).

When nvme_mpath_init() is called multiple times, it overwrites the
ana_log_buf pointer with a new allocation, thus leaking the previous
allocation.

To fix this, free ana_log_buf before allocating a new one.

Fixes: 0d0b660f21 ("nvme: add ANA support")
Cc: <stable@vger.kernel.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2020-02-28 17:23:36 +01:00
..
core.c nvme: fix the parameter order for nvme_get_log in nvme_get_fw_slot_info 2020-02-19 19:54:08 +01:00
fabrics.c nvme-fabrics: allow discovery subsystems accept a kato 2019-09-12 08:50:46 -07:00
fabrics.h nvme: Remove ADMIN_ONLY state 2019-10-14 23:21:44 +09:00
fault_inject.c nvme: enable to inject errors into admin commands 2019-06-21 11:15:50 +02:00
fc.c nvme-fc: fix double-free scenarios on hw queues 2019-11-27 03:00:13 +09:00
hwmon.c nvme: hwmon: add quirk to avoid changing temperature threshold 2019-11-22 02:21:08 +09:00
Kconfig nvme: Add hardware monitoring support 2019-11-12 01:57:35 +09:00
lightnvm.c lightnvm: move metadata mapping to lower level driver 2019-08-06 08:20:10 -06:00
Makefile nvme: Add hardware monitoring support 2019-11-12 01:57:35 +09:00
multipath.c nvme-multipath: Fix memory leak with ana_log_buf 2020-02-28 17:23:36 +01:00
nvme.h nvme-rdma: Avoid preallocating big SGL for data 2019-11-27 02:13:45 +09:00
pci.c nvme-pci: remove nvmeq->tags 2020-02-24 08:38:48 +01:00
rdma.c nvme-rdma: Avoid preallocating big SGL for data 2019-11-27 02:13:45 +09:00
tcp.c for-5.5/drivers-20191121 2019-11-25 11:15:41 -08:00
trace.c nvme: trace: parse Get LBA Status command in detail 2019-08-29 12:55:01 -07:00
trace.h nvme-trace: print result and status in hex format 2019-06-21 11:12:37 +02:00