The patch titled
Subject: drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
has been removed from the -mm tree. Its filename was
fsl_hypervisor-prevent-integer-overflow-in-ioctl.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Dan Carpenter <dan.carpenter(a)oracle.com>
Subject: drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
The "param.count" value is a u64 thatcomes from the user. The code later
in the function assumes that param.count is at least one and if it's not
then it leads to an Oops when we dereference the ZERO_SIZE_PTR.
Also the addition can have an integer overflow which would lead us to
allocate a smaller "pages" array than required. I can't immediately tell
what the possible run times implications are, but it's safest to prevent
the overflow.
Link: http://lkml.kernel.org/r/20181218082129.GE32567@kadam
Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver")
Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Timur Tabi <timur(a)freescale.com>
Cc: Mihai Caraman <mihai.caraman(a)freescale.com>
Cc: Kumar Gala <galak(a)kernel.crashing.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
drivers/virt/fsl_hypervisor.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/virt/fsl_hypervisor.c~fsl_hypervisor-prevent-integer-overflow-in-ioctl
+++ a/drivers/virt/fsl_hypervisor.c
@@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_i
* hypervisor.
*/
lb_offset = param.local_vaddr & (PAGE_SIZE - 1);
+ if (param.count == 0 ||
+ param.count > U64_MAX - lb_offset - PAGE_SIZE + 1)
+ return -EINVAL;
num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
/* Allocate the buffers we need */
_
Patches currently in -mm which might be from dan.carpenter(a)oracle.com are
The patch titled
Subject: drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl
has been removed from the -mm tree. Its filename was
fsl_hypervisor-dereferencing-error-pointers-in-ioctl.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Dan Carpenter <dan.carpenter(a)oracle.com>
Subject: drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl
strndup_user() returns error pointers on error, and then in the error
handling we pass the error pointers to kfree(). It will cause an Oops.
Link: http://lkml.kernel.org/r/20181218082003.GD32567@kadam
Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver")
Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Timur Tabi <timur(a)freescale.com>
Cc: Mihai Caraman <mihai.caraman(a)freescale.com>
Cc: Kumar Gala <galak(a)kernel.crashing.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
drivers/virt/fsl_hypervisor.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
--- a/drivers/virt/fsl_hypervisor.c~fsl_hypervisor-dereferencing-error-pointers-in-ioctl
+++ a/drivers/virt/fsl_hypervisor.c
@@ -331,8 +331,8 @@ static long ioctl_dtprop(struct fsl_hv_i
struct fsl_hv_ioctl_prop param;
char __user *upath, *upropname;
void __user *upropval;
- char *path = NULL, *propname = NULL;
- void *propval = NULL;
+ char *path, *propname;
+ void *propval;
int ret = 0;
/* Get the parameters from the user. */
@@ -344,32 +344,30 @@ static long ioctl_dtprop(struct fsl_hv_i
upropval = (void __user *)(uintptr_t)param.propval;
path = strndup_user(upath, FH_DTPROP_MAX_PATHLEN);
- if (IS_ERR(path)) {
- ret = PTR_ERR(path);
- goto out;
- }
+ if (IS_ERR(path))
+ return PTR_ERR(path);
propname = strndup_user(upropname, FH_DTPROP_MAX_PATHLEN);
if (IS_ERR(propname)) {
ret = PTR_ERR(propname);
- goto out;
+ goto err_free_path;
}
if (param.proplen > FH_DTPROP_MAX_PROPLEN) {
ret = -EINVAL;
- goto out;
+ goto err_free_propname;
}
propval = kmalloc(param.proplen, GFP_KERNEL);
if (!propval) {
ret = -ENOMEM;
- goto out;
+ goto err_free_propname;
}
if (set) {
if (copy_from_user(propval, upropval, param.proplen)) {
ret = -EFAULT;
- goto out;
+ goto err_free_propval;
}
param.ret = fh_partition_set_dtprop(param.handle,
@@ -388,7 +386,7 @@ static long ioctl_dtprop(struct fsl_hv_i
if (copy_to_user(upropval, propval, param.proplen) ||
put_user(param.proplen, &p->proplen)) {
ret = -EFAULT;
- goto out;
+ goto err_free_propval;
}
}
}
@@ -396,10 +394,12 @@ static long ioctl_dtprop(struct fsl_hv_i
if (put_user(param.ret, &p->ret))
ret = -EFAULT;
-out:
- kfree(path);
+err_free_propval:
kfree(propval);
+err_free_propname:
kfree(propname);
+err_free_path:
+ kfree(path);
return ret;
}
_
Patches currently in -mm which might be from dan.carpenter(a)oracle.com are
The patch titled
Subject: userfaultfd: use RCU to free the task struct when fork fails
has been removed from the -mm tree. Its filename was
userfaultfd-use-rcu-to-free-the-task-struct-when-fork-fails.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Andrea Arcangeli <aarcange(a)redhat.com>
Subject: userfaultfd: use RCU to free the task struct when fork fails
The task structure is freed while get_mem_cgroup_from_mm() holds
rcu_read_lock() and dereferences mm->owner.
get_mem_cgroup_from_mm() failing fork()
---- ---
task = mm->owner
mm->owner = NULL;
free(task)
if (task) *task; /* use after free */
The fix consists in freeing the task with RCU also in the fork failure
case, exactly like it always happens for the regular exit(2) path. That
is enough to make the rcu_read_lock hold in get_mem_cgroup_from_mm() (left
side above) effective to avoid a use after free when dereferencing the
task structure.
An alternate possible fix would be to defer the delivery of the
userfaultfd contexts to the monitor until after fork() is guaranteed to
succeed. Such a change would require more changes because it would create
a strict ordering dependency where the uffd methods would need to be
called beyond the last potentially failing branch in order to be safe.
This solution as opposed only adds the dependency to common code to set
mm->owner to NULL and to free the task struct that was pointed by
mm->owner with RCU, if fork ends up failing. The userfaultfd methods can
still be called anywhere during the fork runtime and the monitor will keep
discarding orphaned "mm" coming from failed forks in userland.
This race condition couldn't trigger if CONFIG_MEMCG was set =n at build
time.
[aarcange(a)redhat.com: improve changelog, reduce #ifdefs per Michal]
Link: http://lkml.kernel.org/r/20190429035752.4508-1-aarcange@redhat.com
Link: http://lkml.kernel.org/r/20190325225636.11635-2-aarcange@redhat.com
Fixes: 893e26e61d04 ("userfaultfd: non-cooperative: Add fork() event")
Signed-off-by: Andrea Arcangeli <aarcange(a)redhat.com>
Tested-by: zhong jiang <zhongjiang(a)huawei.com>
Reported-by: syzbot+cbb52e396df3e565ab02(a)syzkaller.appspotmail.com
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: Jann Horn <jannh(a)google.com>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: Mike Rapoport <rppt(a)linux.vnet.ibm.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Peter Xu <peterx(a)redhat.com>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: "Kirill A . Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: zhong jiang <zhongjiang(a)huawei.com>
Cc: syzbot+cbb52e396df3e565ab02(a)syzkaller.appspotmail.com
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
kernel/fork.c | 31 +++++++++++++++++++++++++++++--
1 file changed, 29 insertions(+), 2 deletions(-)
--- a/kernel/fork.c~userfaultfd-use-rcu-to-free-the-task-struct-when-fork-fails
+++ a/kernel/fork.c
@@ -955,6 +955,15 @@ static void mm_init_aio(struct mm_struct
#endif
}
+static __always_inline void mm_clear_owner(struct mm_struct *mm,
+ struct task_struct *p)
+{
+#ifdef CONFIG_MEMCG
+ if (mm->owner == p)
+ WRITE_ONCE(mm->owner, NULL);
+#endif
+}
+
static void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
{
#ifdef CONFIG_MEMCG
@@ -1343,6 +1352,7 @@ static struct mm_struct *dup_mm(struct t
free_pt:
/* don't put binfmt in mmput, we haven't got module yet */
mm->binfmt = NULL;
+ mm_init_owner(mm, NULL);
mmput(mm);
fail_nomem:
@@ -1726,6 +1736,21 @@ static int pidfd_create(struct pid *pid)
return fd;
}
+static void __delayed_free_task(struct rcu_head *rhp)
+{
+ struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
+
+ free_task(tsk);
+}
+
+static __always_inline void delayed_free_task(struct task_struct *tsk)
+{
+ if (IS_ENABLED(CONFIG_MEMCG))
+ call_rcu(&tsk->rcu, __delayed_free_task);
+ else
+ free_task(tsk);
+}
+
/*
* This creates a new process as a copy of the old one,
* but does not actually start it yet.
@@ -2233,8 +2258,10 @@ bad_fork_cleanup_io:
bad_fork_cleanup_namespaces:
exit_task_namespaces(p);
bad_fork_cleanup_mm:
- if (p->mm)
+ if (p->mm) {
+ mm_clear_owner(p->mm, p);
mmput(p->mm);
+ }
bad_fork_cleanup_signal:
if (!(clone_flags & CLONE_THREAD))
free_signal_struct(p->signal);
@@ -2265,7 +2292,7 @@ bad_fork_cleanup_count:
bad_fork_free:
p->state = TASK_DEAD;
put_task_stack(p);
- free_task(p);
+ delayed_free_task(p);
fork_out:
spin_lock_irq(¤t->sighand->siglock);
hlist_del_init(&delayed.node);
_
Patches currently in -mm which might be from aarcange(a)redhat.com are
With CONFIG_LKDTM=y and make OBJCOPY=llvm-objcopy, llvm-objcopy errors:
llvm-objcopy: error: --set-section-flags=.text conflicts with
--rename-section=.text=.rodata
Rather than support setting flags then renaming sections vs renaming
then setting flags, it's simpler to just change both at the same time
via --rename-section. Adding the load flag is required for GNU objcopy
to mark .rodata Type as PROGBITS after the rename.
This can be verified with:
$ readelf -S drivers/misc/lkdtm/rodata_objcopy.o
...
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
...
[ 1] .rodata PROGBITS 0000000000000000 00000040
0000000000000004 0000000000000000 A 0 0 4
...
Which shows that .text is now renamed .rodata, the alloc flag A is set,
the type is PROGBITS, and the section is not flagged as writeable W.
Cc: stable(a)vger.kernel.org
Link: https://sourceware.org/bugzilla/show_bug.cgi?id=24554
Link: https://github.com/ClangBuiltLinux/linux/issues/448
Reported-by: Nathan Chancellor <nathanchance(a)gmail.com>
Suggested-by: Alan Modra <amodra(a)gmail.com>
Suggested-by: Jordan Rupprect <rupprecht(a)google.com>
Suggested-by: Kees Cook <keescook(a)chromium.org>
Acked-by: Kees Cook <keescook(a)chromium.org>
Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com>
---
Changes from v1 -> v2:
* add load flag, as per Kees and Alan.
* update commit message to mention reason for load flag.
* add Kees' and Alan's suggested by.
* carry Kees' Ack.
* cc stable.
drivers/misc/lkdtm/Makefile | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/misc/lkdtm/Makefile b/drivers/misc/lkdtm/Makefile
index 951c984de61a..fb10eafe9bde 100644
--- a/drivers/misc/lkdtm/Makefile
+++ b/drivers/misc/lkdtm/Makefile
@@ -15,8 +15,7 @@ KCOV_INSTRUMENT_rodata.o := n
OBJCOPYFLAGS :=
OBJCOPYFLAGS_rodata_objcopy.o := \
- --set-section-flags .text=alloc,readonly \
- --rename-section .text=.rodata
+ --rename-section .text=.rodata,alloc,readonly,load
targets += rodata.o rodata_objcopy.o
$(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE
$(call if_changed,objcopy)
--
2.21.0.1020.gf2820cf01a-goog
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: eb5d65a82f5c - Linux 5.1.2
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: eb5d65a82f5c - Linux 5.1.2
We then merged the patchset with `git am`:
platform-x86-sony-laptop-fix-unintentional-fall-through.patch
platform-x86-thinkpad_acpi-disable-bluetooth-for-some-machines.patch
platform-x86-dell-laptop-fix-rfkill-functionality.patch
hwmon-pwm-fan-disable-pwm-if-fetching-cooling-data-fails.patch
hwmon-occ-fix-extended-status-bits.patch
selftests-seccomp-handle-namespace-failures-gracefully.patch
i2c-core-ratelimit-transfer-when-suspended-errors.patch
kernfs-fix-barrier-usage-in-__kernfs_new_node.patch
virt-vbox-sanity-check-parameter-types-for-hgcm-calls-coming-from-userspace.patch
usb-serial-fix-unthrottle-races.patch
mwl8k-fix-rate_idx-underflow.patch
rtlwifi-rtl8723ae-fix-missing-break-in-switch-statement.patch
don-t-jump-to-compute_result-state-from-check_result-state.patch
bonding-fix-arp_validate-toggling-in-active-backup-mode.patch
bridge-fix-error-path-for-kobject_init_and_add.patch
dpaa_eth-fix-sg-frame-cleanup.patch
fib_rules-return-0-directly-if-an-exactly-same-rule-exists-when-nlm_f_excl-not-supplied.patch
ipv4-fix-raw-socket-lookup-for-local-traffic.patch
net-dsa-fix-error-cleanup-path-in-dsa_init_module.patch
net-ethernet-stmmac-dwmac-sun8i-enable-support-of-unicast-filtering.patch
net-macb-change-interrupt-and-napi-enable-order-in-open.patch
net-seeq-fix-crash-caused-by-not-set-dev.parent.patch
net-ucc_geth-fix-oops-when-changing-number-of-buffers-in-the-ring.patch
packet-fix-error-path-in-packet_init.patch
selinux-do-not-report-error-on-connect-af_unspec.patch
tipc-fix-hanging-clients-using-poll-with-epollout-flag.patch
vlan-disable-siocshwtstamp-in-container.patch
vrf-sit-mtu-should-not-be-updated-when-vrf-netdev-is-the-link.patch
tuntap-fix-dividing-by-zero-in-ebpf-queue-selection.patch
tuntap-synchronize-through-tfiles-array-instead-of-tun-numqueues.patch
net-phy-fix-phy_validate_pause.patch
flow_dissector-disable-preemption-around-bpf-calls.patch
isdn-bas_gigaset-use-usb_fill_int_urb-properly.patch
drivers-virt-fsl_hypervisor.c-dereferencing-error-pointers-in-ioctl.patch
drivers-virt-fsl_hypervisor.c-prevent-integer-overflow-in-ioctl.patch
powerpc-book3s-64-check-for-null-pointer-in-pgd_alloc.patch
powerpc-powernv-idle-restore-iamr-after-idle.patch
powerpc-booke64-set-ri-in-default-msr.patch
virtio_ring-fix-potential-mem-leak-in-virtqueue_add_indirect_packed.patch
pci-hv-fix-a-memory-leak-in-hv_eject_device_work.patch
pci-hv-add-hv_pci_remove_slots-when-we-unload-the-driver.patch
pci-hv-add-pci_destroy_slot-in-pci_devices_present_work-if-necessary.patch
f2fs-fix-use-of-number-of-devices.patch
Compile testing
---------------
We compiled the kernel for 4 architectures:
aarch64:
build options: -j25 INSTALL_MOD_STRIP=1 targz-pkg
configuration: https://artifacts.cki-project.org/builds/aarch64/kernel-stable_queue_5.1-aa…
kernel build: https://artifacts.cki-project.org/builds/aarch64/kernel-stable_queue_5.1-aa…
ppc64le:
build options: -j25 INSTALL_MOD_STRIP=1 targz-pkg
configuration: https://artifacts.cki-project.org/builds/ppc64le/kernel-stable_queue_5.1-pp…
kernel build: https://artifacts.cki-project.org/builds/ppc64le/kernel-stable_queue_5.1-pp…
s390x:
build options: -j25 INSTALL_MOD_STRIP=1 targz-pkg
configuration: https://artifacts.cki-project.org/builds/s390x/kernel-stable_queue_5.1-s390…
kernel build: https://artifacts.cki-project.org/builds/s390x/kernel-stable_queue_5.1-s390…
x86_64:
build options: -j25 INSTALL_MOD_STRIP=1 targz-pkg
configuration: https://artifacts.cki-project.org/builds/x86_64/kernel-stable_queue_5.1-x86…
kernel build: https://artifacts.cki-project.org/builds/x86_64/kernel-stable_queue_5.1-x86…
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
✅ Boot test [0]
✅ Boot test [0]
✅ LTP lite [1]
✅ Loopdev Sanity [2]
✅ AMTU (Abstract Machine Test Utility) [3]
✅ Ethernet drivers sanity [4]
✅ httpd: mod_ssl smoke sanity [5]
✅ iotop: sanity [6]
✅ tuned: tune-processes-through-perf [7]
🚧 ✅ selinux-policy: serge-testsuite [8]
🚧 ✅ audit: audit testsuite test [9]
🚧 ✅ stress: stress-ng [10]
ppc64le:
✅ Boot test [0]
✅ Boot test [0]
✅ LTP lite [1]
✅ Loopdev Sanity [2]
✅ AMTU (Abstract Machine Test Utility) [3]
✅ Ethernet drivers sanity [4]
✅ httpd: mod_ssl smoke sanity [5]
✅ iotop: sanity [6]
✅ tuned: tune-processes-through-perf [7]
🚧 ✅ selinux-policy: serge-testsuite [8]
🚧 ✅ audit: audit testsuite test [9]
🚧 ✅ stress: stress-ng [10]
s390x:
✅ Boot test [0]
✅ LTP lite [1]
✅ Loopdev Sanity [2]
✅ Ethernet drivers sanity [4]
✅ httpd: mod_ssl smoke sanity [5]
✅ iotop: sanity [6]
✅ tuned: tune-processes-through-perf [7]
✅ Boot test [0]
🚧 ✅ audit: audit testsuite test [9]
🚧 ✅ stress: stress-ng [10]
🚧 ✅ selinux-policy: serge-testsuite [8]
x86_64:
✅ Boot test [0]
✅ Boot test [0]
✅ LTP lite [1]
✅ Loopdev Sanity [2]
✅ AMTU (Abstract Machine Test Utility) [3]
✅ Ethernet drivers sanity [4]
✅ httpd: mod_ssl smoke sanity [5]
✅ iotop: sanity [6]
✅ tuned: tune-processes-through-perf [7]
🚧 ✅ selinux-policy: serge-testsuite [8]
🚧 ✅ audit: audit testsuite test [9]
🚧 ✅ stress: stress-ng [10]
Test source:
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
Waived tests (marked with 🚧)
-----------------------------
This test run included waived tests. Such tests are executed but their results
are not taken into account. Tests are waived when their results are not
reliable enough, e.g. when they're just introduced or are being fixed.
The dm_early_create() function (which deals with "dm-mod.create=" kernel
command line option) calls dm_hash_insert() who gets an extra reference
to the md object.
In case of failure, this reference wasn't being released, causing
dm_destroy() to hang, thus hanging the whole boot process.
Fix this by calling __hash_remove() in the error path.
Fixes: 6bbc923dfcf57d ("dm: add support to directly boot to a mapped device")
Cc: stable(a)vger.kernel.org
Signed-off-by: Helen Koike <helen.koike(a)collabora.com>
---
Hi,
I also tested this patch version with the new test case in the following test
script:
https://gitlab.collabora.com/koike/dm-cmdline-test/commit/d2d7a0ee4a49931cd…
Thanks
Helen
Changes in v2:
- instead of modifying dm_hash_insert() to return the hash cell, use
__get_name_cell(dmi->name) instead.
drivers/md/dm-ioctl.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index c740153b4e52..1e03bc89e20f 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -2069,7 +2069,7 @@ int __init dm_early_create(struct dm_ioctl *dmi,
/* alloc table */
r = dm_table_create(&t, get_mode(dmi), dmi->target_count, md);
if (r)
- goto err_destroy_dm;
+ goto err_hash_remove;
/* add targets */
for (i = 0; i < dmi->target_count; i++) {
@@ -2116,6 +2116,10 @@ int __init dm_early_create(struct dm_ioctl *dmi,
err_destroy_table:
dm_table_destroy(t);
+err_hash_remove:
+ (void) __hash_remove(__get_name_cell(dmi->name));
+ /* release reference from __get_name_cell */
+ dm_put(md);
err_destroy_dm:
dm_put(md);
dm_destroy(md);
--
2.20.1