diff options
| author | Xishi Qiu <qiuxishi@huawei.com> | 2014-03-06 17:18:21 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-03-08 22:08:29 -0800 |
| commit | 92d585ef067da7a966d6ce78c601bd1562b62619 (patch) | |
| tree | c839bfcc6efa0bf6f9d7c485ecb630c5fa130f59 /drivers/base/node.c | |
| parent | aa0689b36b2144e91d2182605bed951565c4899b (diff) | |
| download | linux-next-92d585ef067da7a966d6ce78c601bd1562b62619.tar.gz | |
numa: fix NULL pointer access and memory leak in unregister_one_node()
When doing socket hot remove, "node_devices[nid]" is set to NULL;
acpi_processor_remove()
try_offline_node()
unregister_one_node()
Then hot add a socket, but do not echo 1 > /sys/devices/system/cpu/cpuXX/online,
so register_one_node() will not be called, and "node_devices[nid]"
is still NULL.
If doing socket hot remove again, NULL pointer access will be happen.
unregister_one_node()
unregister_node()
Another, we should free the memory used by "node_devices[nid]" in
unregister_one_node().
Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/base/node.c')
| -rw-r--r-- | drivers/base/node.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/base/node.c b/drivers/base/node.c index bc9f43bf7e29..8f7ed9933a7c 100644 --- a/drivers/base/node.c +++ b/drivers/base/node.c @@ -599,7 +599,11 @@ int register_one_node(int nid) void unregister_one_node(int nid) { + if (!node_devices[nid]) + return; + unregister_node(node_devices[nid]); + kfree(node_devices[nid]); node_devices[nid] = NULL; } |