bcache: fix memory corruption in init error path
If register_cache_set() failed, we would touch ca->set after it had already been freed. Also, fix an assertion to catch this. Change-Id: I748e5f5b223e2d9b2602075dec2f997cced2394d
This commit is contained in:
parent
bf0c55c986
commit
c9a78332b4
|
@ -1356,8 +1356,11 @@ static void cache_set_free(struct closure *cl)
|
|||
bch_journal_free(c);
|
||||
|
||||
for_each_cache(ca, c, i)
|
||||
if (ca)
|
||||
if (ca) {
|
||||
ca->set = NULL;
|
||||
c->cache[ca->sb.nr_this_dev] = NULL;
|
||||
kobject_put(&ca->kobj);
|
||||
}
|
||||
|
||||
bch_bset_sort_state_free(&c->sort);
|
||||
free_pages((unsigned long) c->uuids, ilog2(bucket_pages(c)));
|
||||
|
@ -1794,8 +1797,10 @@ void bch_cache_release(struct kobject *kobj)
|
|||
struct cache *ca = container_of(kobj, struct cache, kobj);
|
||||
unsigned i;
|
||||
|
||||
if (ca->set)
|
||||
if (ca->set) {
|
||||
BUG_ON(ca->set->cache[ca->sb.nr_this_dev] != ca);
|
||||
ca->set->cache[ca->sb.nr_this_dev] = NULL;
|
||||
}
|
||||
|
||||
bio_split_pool_free(&ca->bio_split_hook);
|
||||
|
||||
|
|
Loading…
Reference in New Issue