From: Colin Ian King Date: Wed, 2 Jun 2021 10:06:59 +0000 (+0100) Subject: null_blk: Fix null pointer dereference on nullb->disk on blk_cleanup_disk call X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=90bf3e28ef51aa3f480d2f2151813be669ba69ce;p=linux.git null_blk: Fix null pointer dereference on nullb->disk on blk_cleanup_disk call The error handling on a nullb->disk allocation currently jumps to out_cleanup_disk that calls blk_cleanup_disk with a null pointer causing a null pointer dereference issue. Fix this by jumping to out_cleanup_tags instead. Addresses-Coverity: ("Dereference after null check") Fixes: 132226b301b5 ("null_blk: convert to blk_alloc_disk/blk_cleanup_disk") Signed-off-by: Colin Ian King Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210602100659.11058-1-colin.king@canonical.com Signed-off-by: Jens Axboe --- diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index d8e098f1e5b54..83d803cb57c80 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -1856,7 +1856,7 @@ static int null_add_dev(struct nullb_device *dev) goto out_cleanup_tags; nullb->disk = alloc_disk_node(1, nullb->dev->home_node); if (!nullb->disk) - goto out_cleanup_disk; + goto out_cleanup_tags; nullb->disk->queue = nullb->q; } else if (dev->queue_mode == NULL_Q_BIO) { rv = -ENOMEM;