Messages in this thread | | | Date | Fri, 6 Aug 2004 04:18:16 +0100 | From | viro@parcelfa ... | Subject | Re: Possible dcache BUG |
| |
On Thu, Aug 05, 2004 at 07:50:28PM -0700, Linus Torvalds wrote:
> So as far as I can tell, shrink_dcache_anon() will have _removed_ a dentry > from the unused_list, but still left the dentry with wild pointers > pointing to other dentries. Next time around we do a dput() on such a > dentry, we'll be screwed, because we'll try to remove it again. Boom.
It doesn't even take a dput(). Look: we do list_del(), then notice that sucker still has positive refcount and leave it alone. Now think what happens on the next pass. That's right, we hit that dentry *again*. And see that list_empty() is false. And do list_del() one more time.
However, what used to be e.g. next dentry might very well be freed by now. *BOOM*. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |