[lkml]   [2003]   [Sep]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: __make_request() bug and a fix variant
    On Sat, 20 Sep 2003 13:37:37 +0200
    Jens Axboe <> wrote:

    > You can see the initialisor for buffer_heads is
    > init_buffer_head, which memsets the entire buffer_head. When a
    > buffer_head is detached from the request list, b_reqnext is cleared
    > too.
    I did some more research on this subject. Indeed, I was wrong. The
    problem is that when you acquire a buffer_head by calling
    kmem_cache_alloc and you return it with kmem_cache_free the returned
    buffer can be filled with any garbage *except* the b_reqnext field
    which *should* be set to NULL, otherwise the next driver who'll get this
    buffer_head will most probably crash.

    Not that relying on this field being NULL is a bad practice (because
    in kernel performance is top priority), but it's not clean (and
    nowhere mentioned - even in the source code). So I think it would be a
    Good Thing{tm} to mention somewhere(say at least in buffers.c before
    put_unused_buffer_head) that before returning a buffer to the common
    pool you should ensure that b_reqnext is NULL (although it is not
    related only to put_unused_buffer_head but to kmem_cache_free as well -
    but the later is not related to buffer_head's:).

    Sorry for borrowed time and thank very much for assistance.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:48    [W:0.020 / U:29.560 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site