Re: [PATCH] virtio_blk: NULL out vqs to avoid double free on failed resume
From: "Michael S. Tsirkin" <mst@redhat.com>
Date: 2025-10-21 12:58:01
Also in:
linux-arm-msm, linux-block, lkml
On Tue, Oct 21, 2025 at 07:07:56PM +0800, Cong Zhang wrote:
The vblk->vqs releases during freeze. If resume fails before vblk->vqs is allocated, later freeze/remove may attempt to free vqs again. Set vblk->vqs to NULL after freeing to avoid double free. Signed-off-by: Cong Zhang <redacted> --- The patch fixes a double free issue that occurs in virtio_blk during freeze/resume. The issue is caused by: 1. During the first freeze, vblk->vqs is freed but pointer is not set to NULL. 2. Virtio block device fails before vblk->vqs is allocated during resume. 3. During the next freeze, vblk->vqs gets freed again, causing the double free crash.
this part I don't get. if restore fails, how can freeze be called again?
quoted hunk ↗ jump to hunk
--- drivers/block/virtio_blk.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c index f061420dfb10c40b21765b173fab7046aa447506..746795066d7f56a01c9a9c0344d24f9fa06841eb 100644 --- a/drivers/block/virtio_blk.c +++ b/drivers/block/virtio_blk.c@@ -1026,8 +1026,13 @@ static int init_vq(struct virtio_blk *vblk) out: kfree(vqs); kfree(vqs_info); - if (err) + if (err) { kfree(vblk->vqs); + /* + * Set to NULL to prevent freeing vqs again during freezing. + */ + vblk->vqs = NULL; + } return err; }
quoted hunk ↗ jump to hunk
@@ -1598,6 +1603,12 @@ static int virtblk_freeze_priv(struct virtio_device *vdev) vdev->config->del_vqs(vdev); kfree(vblk->vqs); + /* + * Set to NULL to prevent freeing vqs again after a failed vqs + * allocation during resume. Note that kfree() already handles NULL + * pointers safely. + */ + vblk->vqs = NULL; return 0; }--- base-commit: 8e2755d7779a95dd61d8997ebce33ff8b1efd3fb change-id: 20250926-virtio_double_free-7ab880d82a17 Best regards, -- Cong Zhang [off-list ref]