[v2] block: rnbd-clt: Fix leaked ID in init_dev()

[PATCH v2] block: rnbd-clt: Fix leaked ID in init_dev()

Posted by Thomas Fourier 1 month, 3 weeks ago

If kstrdup() fails in init_dev(), then the newly allocated ID is lost.

Fixes: 64e8a6ece1a5 ("block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
v1->v2:
  - store id in dev directly

 drivers/block/rnbd/rnbd-clt.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/block/rnbd/rnbd-clt.c b/drivers/block/rnbd/rnbd-clt.c
index f1409e54010a..d1c354636315 100644
--- a/drivers/block/rnbd/rnbd-clt.c
+++ b/drivers/block/rnbd/rnbd-clt.c
@@ -1423,9 +1423,11 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
 		goto out_alloc;
 	}
 
-	ret = ida_alloc_max(&index_ida, (1 << (MINORBITS - RNBD_PART_BITS)) - 1,
-			    GFP_KERNEL);
-	if (ret < 0) {
+	dev->clt_device_id = ida_alloc_max(&index_ida,
+					   (1 << (MINORBITS - RNBD_PART_BITS)) - 1,
+					   GFP_KERNEL);
+	if (dev->clt_device_id < 0) {
+		ret = dev->clt_device_id;
 		pr_err("Failed to initialize device '%s' from session %s, allocating idr failed, err: %d\n",
 		       pathname, sess->sessname, ret);
 		goto out_queues;
@@ -1434,10 +1436,9 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
 	dev->pathname = kstrdup(pathname, GFP_KERNEL);
 	if (!dev->pathname) {
 		ret = -ENOMEM;
-		goto out_queues;
+		goto out_ida;
 	}
 
-	dev->clt_device_id	= ret;
 	dev->sess		= sess;
 	dev->access_mode	= access_mode;
 	dev->nr_poll_queues	= nr_poll_queues;
@@ -1453,6 +1454,8 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
 
 	return dev;
 
+out_ida:
+	ida_free(&index_ida, dev->clt_device_id);
 out_queues:
 	kfree(dev->hw_queues);
 out_alloc:
-- 
2.43.0

Re: [PATCH v2] block: rnbd-clt: Fix leaked ID in init_dev()

Posted by Jens Axboe 1 month, 2 weeks ago

On Wed, 17 Dec 2025 10:36:48 +0100, Thomas Fourier wrote:
> If kstrdup() fails in init_dev(), then the newly allocated ID is lost.
> 
> 

Applied, thanks!

[1/1] block: rnbd-clt: Fix leaked ID in init_dev()
      commit: c9b5645fd8ca10f310e41b07540f98e6a9720f40

Best regards,
-- 
Jens Axboe

Re: [PATCH v2] block: rnbd-clt: Fix leaked ID in init_dev()

Posted by Jinpu Wang 1 month, 2 weeks ago

On Wed, Dec 17, 2025 at 10:37 AM Thomas Fourier
<fourier.thomas@gmail.com> wrote:
>
> If kstrdup() fails in init_dev(), then the newly allocated ID is lost.
>
> Fixes: 64e8a6ece1a5 ("block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name")
> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Acked-by: Jack Wang <jinpu.wang@ionos.com>
> ---
> v1->v2:
>   - store id in dev directly
>
>  drivers/block/rnbd/rnbd-clt.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/block/rnbd/rnbd-clt.c b/drivers/block/rnbd/rnbd-clt.c
> index f1409e54010a..d1c354636315 100644
> --- a/drivers/block/rnbd/rnbd-clt.c
> +++ b/drivers/block/rnbd/rnbd-clt.c
> @@ -1423,9 +1423,11 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
>                 goto out_alloc;
>         }
>
> -       ret = ida_alloc_max(&index_ida, (1 << (MINORBITS - RNBD_PART_BITS)) - 1,
> -                           GFP_KERNEL);
> -       if (ret < 0) {
> +       dev->clt_device_id = ida_alloc_max(&index_ida,
> +                                          (1 << (MINORBITS - RNBD_PART_BITS)) - 1,
> +                                          GFP_KERNEL);
> +       if (dev->clt_device_id < 0) {
> +               ret = dev->clt_device_id;
>                 pr_err("Failed to initialize device '%s' from session %s, allocating idr failed, err: %d\n",
>                        pathname, sess->sessname, ret);
>                 goto out_queues;
> @@ -1434,10 +1436,9 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
>         dev->pathname = kstrdup(pathname, GFP_KERNEL);
>         if (!dev->pathname) {
>                 ret = -ENOMEM;
> -               goto out_queues;
> +               goto out_ida;
>         }
>
> -       dev->clt_device_id      = ret;
>         dev->sess               = sess;
>         dev->access_mode        = access_mode;
>         dev->nr_poll_queues     = nr_poll_queues;
> @@ -1453,6 +1454,8 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
>
>         return dev;
>
> +out_ida:
> +       ida_free(&index_ida, dev->clt_device_id);
>  out_queues:
>         kfree(dev->hw_queues);
>  out_alloc:
> --
> 2.43.0
>