github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

dm-snapshot: fix crash if dm_io_client_create fails

Browse Source 
If dm_io_client_create() fails, it stores error into the ps->io_client
variable. The code would try to free it later with
dm_io_client_destroy(ps->io_client), causing an invalid pointer
dereference. Fix this by setting ps->io_client = NULL.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
This commit is contained in:
Mikulas Patocka 2026-10-09 18:14:45 +02:00
parent 1acc65c30f
commit 829c4d2114
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/md/dm-snap-persistent.c
View File

@ -325,8 +325,11 @@ static int read_header(struct pstore *ps, int *new_snapshot)
}
ps->io_client = dm_io_client_create();
if (IS_ERR(ps->io_client))
return PTR_ERR(ps->io_client);
if (IS_ERR(ps->io_client)) {
r = PTR_ERR(ps->io_client);
ps->io_client = NULL;
return r;
}
r = alloc_area(ps);
if (r)