lkml.org 
[lkml]   [2017]   [Feb]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] block: fix double-free in the failure path of cgwb_bdi_init()
From
Date
On 02/08/2017 01:19 PM, Tejun Heo wrote:
> When !CONFIG_CGROUP_WRITEBACK, bdi has single bdi_writeback_congested
> at bdi->wb_congested. cgwb_bdi_init() allocates it with kzalloc() and
> doesn't do further initialization. This usually works fine as the
> reference count gets bumped to 1 by wb_init() and the put from
> wb_exit() releases it.
>
> However, when wb_init() fails, it puts the wb base ref automatically
> freeing the wb and the explicit kfree() in cgwb_bdi_init() error path
> ends up trying to free the same pointer the second time causing a
> double-free.
>
> Fix it by explicitly initilizing the refcnt to 1 and putting the base
> ref from cgwb_bdi_destroy().

Queued up for 4.11.

--
Jens Axboe

\
 
 \ /
  Last update: 2017-02-08 23:32    [W:0.088 / U:0.348 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site