On 6/4/26 11:19 AM, Konstantin Khorenko wrote:
In ploop_add_delta() the kcalloc() failure path for deltas[level].mtfile
set a POSITIVE errno:
if (!deltas[level].mtfile) {
ret = ENOMEM;
goto out;
}
The only caller, ploop_add_deltas_stack(), treats the result as an error
with "if (ret < 0)", so a positive ENOMEM is not recognised as failure:
the stack-setup loop completes and returns 0 (success) while
deltas[level].mtfile stays NULL. Later IO paths then dereference
mtfile[pio->runner_id] (e.g. in the per-runner submit path) and NULL-deref.
Negate the value to -ENOMEM so the error is propagated.
Fixes: 16b86ada6062 ("dm-ploop: use filp per thread")
https://virtuozzo.atlassian.net/browse/VSTOR-132310
Signed-off-by: Konstantin Khorenko <[email protected]>
Reviewed-by: Vasileios Almpanis <[email protected]>
---
drivers/md/dm-ploop-bat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-ploop-bat.c b/drivers/md/dm-ploop-bat.c
index 7746babf04a7..a7849de8aaa6 100644
--- a/drivers/md/dm-ploop-bat.c
+++ b/drivers/md/dm-ploop-bat.c
@@ -507,7 +507,7 @@ int ploop_add_delta(struct ploop *ploop, u32 level, struct
file *file, bool is_r
deltas[level].mtfile = kcalloc(ploop->nkt_runners, sizeof(*file),
GFP_KERNEL);
if (!deltas[level].mtfile) {
- ret = ENOMEM;
+ ret = -ENOMEM;
goto out;
}
for (i = 0; i < ploop->nkt_runners; i++) {
--
Best regards, Vasileios Almpanis
Software Developer, Virtuozzo.
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
