]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
block: rnbd-clt: Fix leaked ID in init_dev()
authorThomas Fourier <fourier.thomas@gmail.com>
Wed, 17 Dec 2025 09:36:48 +0000 (10:36 +0100)
committerJens Axboe <axboe@kernel.dk>
Thu, 18 Dec 2025 15:10:28 +0000 (08:10 -0700)
If kstrdup() fails in init_dev(), then the newly allocated ID is lost.

Fixes: 64e8a6ece1a5 ("block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/block/rnbd/rnbd-clt.c

index f1409e54010a67ec3da8b00b8dd5341c7f5d995e..d1c354636315d2e4e75340dcd226a11000ba26c6 100644 (file)
@@ -1423,9 +1423,11 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
                goto out_alloc;
        }
 
-       ret = ida_alloc_max(&index_ida, (1 << (MINORBITS - RNBD_PART_BITS)) - 1,
-                           GFP_KERNEL);
-       if (ret < 0) {
+       dev->clt_device_id = ida_alloc_max(&index_ida,
+                                          (1 << (MINORBITS - RNBD_PART_BITS)) - 1,
+                                          GFP_KERNEL);
+       if (dev->clt_device_id < 0) {
+               ret = dev->clt_device_id;
                pr_err("Failed to initialize device '%s' from session %s, allocating idr failed, err: %d\n",
                       pathname, sess->sessname, ret);
                goto out_queues;
@@ -1434,10 +1436,9 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
        dev->pathname = kstrdup(pathname, GFP_KERNEL);
        if (!dev->pathname) {
                ret = -ENOMEM;
-               goto out_queues;
+               goto out_ida;
        }
 
-       dev->clt_device_id      = ret;
        dev->sess               = sess;
        dev->access_mode        = access_mode;
        dev->nr_poll_queues     = nr_poll_queues;
@@ -1453,6 +1454,8 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
 
        return dev;
 
+out_ida:
+       ida_free(&index_ida, dev->clt_device_id);
 out_queues:
        kfree(dev->hw_queues);
 out_alloc: