virtio_blk: NULL out vqs to avoid double free on failed resume

The vblk->vqs releases during freeze. If resume fails before vblk->vqs
is allocated, later freeze/remove may attempt to free vqs again.
Set vblk->vqs to NULL after freeing to avoid double free.

Signed-off-by: Cong Zhang <cong.zhang@oss.qualcomm.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index a5e97f03dbf0e9d0b26880589cc136885190a616..357434bdae9989bd830e97ec224825ceccf529c3 100644 (file)
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -1027,8 +1027,13 @@ static int init_vq(struct virtio_blk *vblk)
 out:
        kfree(vqs);
        kfree(vqs_info);
-       if (err)
+       if (err) {
                kfree(vblk->vqs);
+               /*
+                * Set to NULL to prevent freeing vqs again during freezing.
+                */
+               vblk->vqs = NULL;
+       }
        return err;
 }
 
@@ -1599,6 +1604,12 @@ static int virtblk_freeze_priv(struct virtio_device *vdev)
 
        vdev->config->del_vqs(vdev);
        kfree(vblk->vqs);
+       /*
+        * Set to NULL to prevent freeing vqs again after a failed vqs
+        * allocation during resume. Note that kfree() already handles NULL
+        * pointers safely.
+        */
+       vblk->vqs = NULL;
 
        return 0;
 }