Re: [PATCH 18/18] bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This patch is missing the following chunk from the original patch:

@@ -1790,7 +1792,6 @@ static void run_cache_set(struct cache_set *c)
        set_gc_sectors(c);

        if (CACHE_SYNC(&c->sb)) {
-               LIST_HEAD(journal);
                struct bkey *k;
                struct jset *j;

Unless I'm missing something, without this chunk this patch doesn't do anything, as the "journal" that is allocated is the inner one, while the "journal" that is freed is the outer one.


On Thu, 25 Apr 2019, Coly Li wrote:

From: Shenghui Wang <shhuiw@xxxxxxxxxxx>

In the CACHE_SYNC branch of run_cache_set(), LIST_HEAD(journal) is used
to collect journal_replay(s) and filled by bch_journal_read().

If all goes well, bch_journal_replay() will release the list of
jounal_replay(s) at the end of the branch.

If something goes wrong, code flow will jump to the label "err:" and leave
the list unreleased.

This patch will release the list of journal_replay(s) in the case of
error detected.

v1 -> v2:
* Move the release code to the location after label 'err:' to
 simply the change.

Signed-off-by: Shenghui Wang <shhuiw@xxxxxxxxxxx>
Signed-off-by: Coly Li <colyli@xxxxxxx>
---
drivers/md/bcache/super.c | 8 ++++++++
1 file changed, 8 insertions(+)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 3f34b96ebbc3..0ffe9acee9d8 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1790,6 +1790,8 @@ static int run_cache_set(struct cache_set *c)
	struct cache *ca;
	struct closure cl;
	unsigned int i;
+	LIST_HEAD(journal);
+	struct journal_replay *l;

	closure_init_stack(&cl);

@@ -1949,6 +1951,12 @@ static int run_cache_set(struct cache_set *c)
	set_bit(CACHE_SET_RUNNING, &c->flags);
	return 0;
err:
+	while (!list_empty(&journal)) {
+		l = list_first_entry(&journal, struct journal_replay, list);
+		list_del(&l->list);
+		kfree(l);
+	}
+
	closure_sync(&cl);
	/* XXX: test this, it's broken */
	bch_cache_set_error(c, "%s", err);




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux ARM Kernel]     [Linux Filesystem Development]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux