diff mbox series

[-next,1/3] nbd: fold nbd config initialization into nbd_alloc_config()

Message ID 20230707031536.666482-2-zhongjinghua@huaweicloud.com (mailing list archive)
State New, archived
Headers show
Series nbd: fix null-ptr-dereference while accessing 'nbd->config' | expand

Commit Message

zhongjinghua July 7, 2023, 3:15 a.m. UTC 
From: Zhong Jinghua <zhongjinghua@huawei.com>

There are no functional changes, make the code cleaner and prepare to
fix null-ptr-dereference while accessing 'nbd->config'.

Signed-off-by: Zhong Jinghua <zhongjinghua@huawei.com>
---
 drivers/block/nbd.c | 41 +++++++++++++++++++----------------------
 1 file changed, 19 insertions(+), 22 deletions(-)

Comments

Yu Kuai Sept. 28, 2023, 6:05 a.m. UTC | #1 
在 2023/07/07 11:15, Zhong Jinghua 写道:
> From: Zhong Jinghua <zhongjinghua@huawei.com>
> 
> There are no functional changes, make the code cleaner and prepare to
> fix null-ptr-dereference while accessing 'nbd->config'.
> 

LGTM
Reviewed-by: Yu Kuai <yukuai3@huawei.com>

> Signed-off-by: Zhong Jinghua <zhongjinghua@huawei.com>
> ---
>   drivers/block/nbd.c | 41 +++++++++++++++++++----------------------
>   1 file changed, 19 insertions(+), 22 deletions(-)
> 
> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> index cb38477f359f..cd6d78914954 100644
> --- a/drivers/block/nbd.c
> +++ b/drivers/block/nbd.c
> @@ -1526,17 +1526,20 @@ static int nbd_ioctl(struct block_device *bdev, fmode_t mode,
>   	return error;
>   }
>   
> -static struct nbd_config *nbd_alloc_config(void)
> +static int nbd_alloc_and_init_config(struct nbd_device *nbd)
>   {
>   	struct nbd_config *config;
>   
> +	if (WARN_ON(nbd->config))
> +		return -EINVAL;
> +
>   	if (!try_module_get(THIS_MODULE))
> -		return ERR_PTR(-ENODEV);
> +		return -ENODEV;
>   
>   	config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
>   	if (!config) {
>   		module_put(THIS_MODULE);
> -		return ERR_PTR(-ENOMEM);
> +		return -ENOMEM;
>   	}
>   
>   	atomic_set(&config->recv_threads, 0);
> @@ -1544,7 +1547,10 @@ static struct nbd_config *nbd_alloc_config(void)
>   	init_waitqueue_head(&config->conn_wait);
>   	config->blksize_bits = NBD_DEF_BLKSIZE_BITS;
>   	atomic_set(&config->live_connections, 0);
> -	return config;
> +	nbd->config = config;
> +	refcount_set(&nbd->config_refs, 1);
> +
> +	return 0;
>   }
>   
>   static int nbd_open(struct block_device *bdev, fmode_t mode)
> @@ -1563,21 +1569,17 @@ static int nbd_open(struct block_device *bdev, fmode_t mode)
>   		goto out;
>   	}
>   	if (!refcount_inc_not_zero(&nbd->config_refs)) {
> -		struct nbd_config *config;
> -
>   		mutex_lock(&nbd->config_lock);
>   		if (refcount_inc_not_zero(&nbd->config_refs)) {
>   			mutex_unlock(&nbd->config_lock);
>   			goto out;
>   		}
> -		config = nbd_alloc_config();
> -		if (IS_ERR(config)) {
> -			ret = PTR_ERR(config);
> +		ret = nbd_alloc_and_init_config(nbd);
> +		if (ret) {
>   			mutex_unlock(&nbd->config_lock);
>   			goto out;
>   		}
> -		nbd->config = config;
> -		refcount_set(&nbd->config_refs, 1);
> +
>   		refcount_inc(&nbd->refs);
>   		mutex_unlock(&nbd->config_lock);
>   		if (max_part)
> @@ -1979,22 +1981,17 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
>   		pr_err("nbd%d already in use\n", index);
>   		return -EBUSY;
>   	}
> -	if (WARN_ON(nbd->config)) {
> -		mutex_unlock(&nbd->config_lock);
> -		nbd_put(nbd);
> -		return -EINVAL;
> -	}
> -	config = nbd_alloc_config();
> -	if (IS_ERR(config)) {
> +
> +	ret = nbd_alloc_and_init_config(nbd);
> +	if (ret) {
>   		mutex_unlock(&nbd->config_lock);
>   		nbd_put(nbd);
>   		pr_err("couldn't allocate config\n");
> -		return PTR_ERR(config);
> +		return ret;
>   	}
> -	nbd->config = config;
> -	refcount_set(&nbd->config_refs, 1);
> -	set_bit(NBD_RT_BOUND, &config->runtime_flags);
>   
> +	config = nbd->config;
> +	set_bit(NBD_RT_BOUND, &config->runtime_flags);
>   	ret = nbd_genl_size_set(info, nbd);
>   	if (ret)
>   		goto out;
>
diff mbox series

Patch

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index cb38477f359f..cd6d78914954 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1526,17 +1526,20 @@  static int nbd_ioctl(struct block_device *bdev, fmode_t mode,
 	return error;
 }
 
-static struct nbd_config *nbd_alloc_config(void)
+static int nbd_alloc_and_init_config(struct nbd_device *nbd)
 {
 	struct nbd_config *config;
 
+	if (WARN_ON(nbd->config))
+		return -EINVAL;
+
 	if (!try_module_get(THIS_MODULE))
-		return ERR_PTR(-ENODEV);
+		return -ENODEV;
 
 	config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
 	if (!config) {
 		module_put(THIS_MODULE);
-		return ERR_PTR(-ENOMEM);
+		return -ENOMEM;
 	}
 
 	atomic_set(&config->recv_threads, 0);
@@ -1544,7 +1547,10 @@  static struct nbd_config *nbd_alloc_config(void)
 	init_waitqueue_head(&config->conn_wait);
 	config->blksize_bits = NBD_DEF_BLKSIZE_BITS;
 	atomic_set(&config->live_connections, 0);
-	return config;
+	nbd->config = config;
+	refcount_set(&nbd->config_refs, 1);
+
+	return 0;
 }
 
 static int nbd_open(struct block_device *bdev, fmode_t mode)
@@ -1563,21 +1569,17 @@  static int nbd_open(struct block_device *bdev, fmode_t mode)
 		goto out;
 	}
 	if (!refcount_inc_not_zero(&nbd->config_refs)) {
-		struct nbd_config *config;
-
 		mutex_lock(&nbd->config_lock);
 		if (refcount_inc_not_zero(&nbd->config_refs)) {
 			mutex_unlock(&nbd->config_lock);
 			goto out;
 		}
-		config = nbd_alloc_config();
-		if (IS_ERR(config)) {
-			ret = PTR_ERR(config);
+		ret = nbd_alloc_and_init_config(nbd);
+		if (ret) {
 			mutex_unlock(&nbd->config_lock);
 			goto out;
 		}
-		nbd->config = config;
-		refcount_set(&nbd->config_refs, 1);
+
 		refcount_inc(&nbd->refs);
 		mutex_unlock(&nbd->config_lock);
 		if (max_part)
@@ -1979,22 +1981,17 @@  static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
 		pr_err("nbd%d already in use\n", index);
 		return -EBUSY;
 	}
-	if (WARN_ON(nbd->config)) {
-		mutex_unlock(&nbd->config_lock);
-		nbd_put(nbd);
-		return -EINVAL;
-	}
-	config = nbd_alloc_config();
-	if (IS_ERR(config)) {
+
+	ret = nbd_alloc_and_init_config(nbd);
+	if (ret) {
 		mutex_unlock(&nbd->config_lock);
 		nbd_put(nbd);
 		pr_err("couldn't allocate config\n");
-		return PTR_ERR(config);
+		return ret;
 	}
-	nbd->config = config;
-	refcount_set(&nbd->config_refs, 1);
-	set_bit(NBD_RT_BOUND, &config->runtime_flags);
 
+	config = nbd->config;
+	set_bit(NBD_RT_BOUND, &config->runtime_flags);
 	ret = nbd_genl_size_set(info, nbd);
 	if (ret)
 		goto out;