On Mon, Aug 03, 2020 at 03:58:58PM +0800, Liwei Song wrote: > exist the following assignment in ccp(ignore the force > convert of the struct) by list_del in ccp_dequeue_cmd(): > req->__ctx->cmd->entry->next = LIST_POISON1; > > after use the req, kzfree(req) can not zero the entry > entry->next = LIST_POISON1 of the ccp_cmd(cmd) struct > when this address available as slub freelist pointer, this will cause > the following "general protection fault" error if some process meet > this LIST_POISON1 value address when request memory: Your description makes no sense. Please rewrite it and explain the problem properly. Thanks, -- Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
