On 02/08/2017 01:19 PM, Tejun Heo wrote: > When !CONFIG_CGROUP_WRITEBACK, bdi has single bdi_writeback_congested > at bdi->wb_congested. cgwb_bdi_init() allocates it with kzalloc() and > doesn't do further initialization. This usually works fine as the > reference count gets bumped to 1 by wb_init() and the put from > wb_exit() releases it. > > However, when wb_init() fails, it puts the wb base ref automatically > freeing the wb and the explicit kfree() in cgwb_bdi_init() error path > ends up trying to free the same pointer the second time causing a > double-free. > > Fix it by explicitly initilizing the refcnt to 1 and putting the base > ref from cgwb_bdi_destroy(). Queued up for 4.11. -- Jens Axboe -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
