hi,Markus
在 2021/1/29 3:42, Markus Elfring 写道:
…
+++ b/drivers/block/nbd.c
@@ -2011,12 +2011,20 @@ static int nbd_genl_disconnect(struct sk_buff *skb,
struct genl_info *info)
index);
return -EINVAL;
}
+ mutex_lock(>config_lock);
if
Open /dev/nbdX first, the config_refs will be 1 and
the pointers in nbd_device are still null. Disconnect
/dev/nbdX, then reference a null recv_workq. The
protection by config_refs in nbd_genl_disconnect is useless.
[ 656.366194] BUG: kernel NULL pointer dereference, address: 0020
[
2 matches
Mail list logo