Messages in this thread | | | From | Dirk Gouders <> | Subject | Re: Slab corruption in floppy driver module | Date | Thu, 26 Jan 2012 19:53:07 +0100 |
| |
Tejun Heo <tj@kernel.org> writes:
> Hello, > > On Thu, Jan 26, 2012 at 10:04:20AM -0500, Vivek Goyal wrote: >> out_put_disk: >> while (dr--) { >> del_timer_sync(&motor_off_timer[dr]); >> - if (disks[dr]->queue) >> + if (disks[dr]->queue) { >> blk_cleanup_queue(disks[dr]->queue); >> + /* >> + * The request queue reference we took at device >> + * creation time has been put by above >> + * blk_cleanup_queue(). We have not called add_disk() >> + * yet and due to failure calling put_disk(). Put disk >> + * will try to put a reference to disk->queue which is >> + * taken in add_disk(). As we have not taken that >> + * extra reference, putting extra reference down >> + * will try to access already freed queue. Clear >> + * disk->queue before calling put_disk(). >> + */ >> + disks[dr]->queue = NULL; > > Yeah, this looks correct to me. It might be better to tone down the > comment a bit tho. Wouldn't it be sufficient to say put_disk() isn't > paired with add_disk() and will put one extra time?
I tested the patch on my machine without a floppy controller and it no longer produces traces, just "floppy0: no floppy controllers found"
Dirk
| |