lkml.org 
[lkml]   [2015]   [Jun]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] zsmalloc: fix a null pointer dereference in destroy_handle_cache()
Date
zs_destroy_pool()->destroy_handle_cache() invoked from
zs_create_pool() can pass a NULL ->handle_cachep pointer
to kmem_cache_destroy(), which will dereference it.

Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
---
mm/zsmalloc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 33d5126..c766240 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -285,7 +285,8 @@ static int create_handle_cache(struct zs_pool *pool)

static void destroy_handle_cache(struct zs_pool *pool)
{
- kmem_cache_destroy(pool->handle_cachep);
+ if (pool->handle_cachep)
+ kmem_cache_destroy(pool->handle_cachep);
}

static unsigned long alloc_handle(struct zs_pool *pool)
--
2.4.2.387.gf86f31a


\
 
 \ /
  Last update: 2015-06-05 13:41    [W:0.097 / U:0.540 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site