Messages in this thread | | | Date | Thu, 26 Jan 2012 10:05:32 -0800 | From | Tejun Heo <> | Subject | Re: Slab corruption in floppy driver module |
| |
Hello,
On Thu, Jan 26, 2012 at 10:04:20AM -0500, Vivek Goyal wrote: > out_put_disk: > while (dr--) { > del_timer_sync(&motor_off_timer[dr]); > - if (disks[dr]->queue) > + if (disks[dr]->queue) { > blk_cleanup_queue(disks[dr]->queue); > + /* > + * The request queue reference we took at device > + * creation time has been put by above > + * blk_cleanup_queue(). We have not called add_disk() > + * yet and due to failure calling put_disk(). Put disk > + * will try to put a reference to disk->queue which is > + * taken in add_disk(). As we have not taken that > + * extra reference, putting extra reference down > + * will try to access already freed queue. Clear > + * disk->queue before calling put_disk(). > + */ > + disks[dr]->queue = NULL;
Yeah, this looks correct to me. It might be better to tone down the comment a bit tho. Wouldn't it be sufficient to say put_disk() isn't paired with add_disk() and will put one extra time?
Thanks.
-- tejun
| |