Tejun Heo <tj@xxxxxxxxxx> writes: > If the cfq_queue cached in cfq_io_cq is the oom one, cfq_set_request() > replaces it by invoking cfq_get_queue() again without putting the oom > queue leaking the reference it was holding. While oom queues are not > released through reference counting, they're still reference counted > and this can theoretically lead to the reference count overflowing and > incorrectly invoke the usual release path on it. > > Fix it by making cfq_set_request() put the ref it was holding. > > Signed-off-by: Tejun Heo <tj@xxxxxxxxxx> > Cc: Vivek Goyal <vgoyal@xxxxxxxxxx> > Cc: Arianna Avanzini <avanzini.arianna@xxxxxxxxx> Reviewed-by: Jeff Moyer <jmoyer@xxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
