Messages in this thread | | | Date | Tue, 13 Mar 2012 15:47:49 -0700 | From | Tejun Heo <> | Subject | Re: [PATCH v2] block: fix ioc leak in put_io_context |
| |
On Wed, Mar 14, 2012 at 06:44:22AM +0800, Xiaotian Feng wrote: > On Tue, Mar 13, 2012 at 11:49 PM, Tejun Heo <tj@kernel.org> wrote: > > On Tue, Mar 13, 2012 at 10:28:20AM -0400, Vivek Goyal wrote: > >> On Tue, Mar 13, 2012 at 01:21:06PM -0400, Xiaotian Feng wrote: > >> > diff --git a/block/blk-ioc.c b/block/blk-ioc.c > >> > index 8b782a6..9690f27 100644 > >> > --- a/block/blk-ioc.c > >> > +++ b/block/blk-ioc.c > >> > @@ -145,6 +145,7 @@ static void ioc_release_fn(struct work_struct *work) > >> > void put_io_context(struct io_context *ioc) > >> > { > >> > unsigned long flags; > >> > + bool free_ioc = false; > >> > > >> > if (ioc == NULL) > >> > return; > >> > @@ -159,8 +160,13 @@ void put_io_context(struct io_context *ioc) > >> > spin_lock_irqsave(&ioc->lock, flags); > >> > if (!hlist_empty(&ioc->icq_list)) > >> > schedule_work(&ioc->release_work); > >> > + else > >> > + free_ioc = true; > > > > Calling kmem_cache_free() here directly is probably better. > > I did this on my first try, but I got a kernel warning with the > following spin_unlock on ioc->lock :( > We'll hit a use after free bug then...
Ah, you're right. Thanks.
-- tejun -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |