![]() | |||||||||||
Messages in this thread Complete thread (EXPERIMENTAL)Patch in this message |
fs/inode.c:prune_icache() does list_del(&inode->i_hash), and then calls destroy_inode(). Inode is returned to the slab with ->i_hash still containing dangling pointers. Probably this wasn't observed so far, because prune_icache() is called during memory pressure and slab page where inode is returned back into, is almost immediately released. 2.4 explicitly calls INIT_LIST_HEAD(&inode->i_hash) in prune_icache(). Following patch re-initializes ->i_hash. Nikita. [view this diff only] ===== fs/inode.c 1.84 vs edited ===== --- 1.84/fs/inode.c Mon Dec 16 09:38:48 2002 +++ edited/fs/inode.c Wed Dec 25 16:19:10 2002 @@ -248,7 +248,7 @@ struct inode *inode; inode = list_entry(head->next, struct inode, i_list); - list_del(&inode->i_list); + list_del_init(&inode->i_list); if (inode->i_data.nrpages) truncate_inode_pages(&inode->i_data, 0); | ||||||||||
![]() | |||||||||||
| Last update: 2005-03-22 12:31 [W:0.122 / U:0.110 seconds] ©2003-2005 Jasper Spaans | |||||||||||