nbd_genl_connect() allocates nbd->backend before creating the backend
sysfs file. If device_create_file() fails, NBD_RT_HAS_BACKEND_FILE
is not set, so nbd_config_put() skips kfree() and leaks the string.
Fix by freeing nbd->backend independently of NBD_RT_HAS_BACKEND_FILE.
Closes: https://lore.kernel.org/all/B518B1A813407AC5+004c9da2-4504-44ce-ac1b-7b46bf0c30db@smail.nju.edu.cn/
Fixes: 6497ef8df568 ("nbd: provide a way for userspace processes to identify device backends")
Cc: stable@vger.kernel.org
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Assisted-by: LLM
---
drivers/block/nbd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index ffce519bf008..1e8bde3450c6 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1486,9 +1486,9 @@ static void nbd_config_put(struct nbd_device *nbd)
if (test_and_clear_bit(NBD_RT_HAS_BACKEND_FILE,
&config->runtime_flags)) {
device_remove_file(disk_to_dev(nbd->disk), &backend_attr);
- kfree(nbd->backend);
- nbd->backend = NULL;
}
+ kfree(nbd->backend);
+ nbd->backend = NULL;
nbd_clear_sock(nbd);
if (config->num_connections) {
int i;