From 19cfba7624a31bc5790a335158244b29657e9253 Mon Sep 17 00:00:00 2001 From: Marcin Spiewak Date: Fri, 19 Jan 2024 12:30:41 +0100 Subject: [PATCH] lib/nvme: fixed use-after-free detected by Coverity If cuse_nvme_ctrlr_update_namespaces(ctrlr_device) fails, the cuse_nvme_ctrlr_stop(ctrlr_device) function is called. This function frees ctrl_device, and also clears/frees bit arrays, so there is no need to jump to clear_and_free label, as these operations ale already done. Just return with appropriate error code. If there is a jump, we will try to access already freed memory (ctrl_device->index) in line 1213 Change-Id: I4217c3783a22781feabbae9735d44479c5f511d9 Signed-off-by: Marcin Spiewak Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/21518 Community-CI: Mellanox Build Bot Reviewed-by: Konrad Sztyber Reviewed-by: Aleksey Marchuk Tested-by: SPDK CI Jenkins --- lib/nvme/nvme_cuse.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/nvme/nvme_cuse.c b/lib/nvme/nvme_cuse.c index 62d1422..0a78b8e 100644 --- a/lib/nvme/nvme_cuse.c +++ b/lib/nvme/nvme_cuse.c @@ -904,8 +904,7 @@ nvme_cuse_start(struct spdk_nvme_ctrlr *ctrlr) if (cuse_nvme_ctrlr_update_namespaces(ctrlr_device) < 0) { SPDK_ERRLOG("Cannot start CUSE namespace devices."); cuse_nvme_ctrlr_stop(ctrlr_device); - rv = -1; - goto err3; + return -1; } return 0; -- 2.27.0