ext4: fix a double free in ext4_register_li_request
In ext4_register_li_request, we malloc a ext4_li_request and inserts it into ext4_li_info->li_request_list. In case of any error later, we free it in the end. But if we have some error in ext4_run_lazyinit_thread, the whole li_request_list will be dropped and freed in it. So we will double free this ext4_li_request. This patch just sets elr to NULL after it is inserted to the list so that the latter kfree won't double free it. Signed-off-by: Tao Ma <boyu.mt@taobao.com> Reviewed-by: Lukas Czerner <lczerner@redhat.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: stable@kernel.org
This commit is contained in:
parent
5b41395fcc
commit
46e4690bbd
|
@ -2975,6 +2975,12 @@ static int ext4_register_li_request(struct super_block *sb,
|
|||
mutex_unlock(&ext4_li_info->li_list_mtx);
|
||||
|
||||
sbi->s_li_request = elr;
|
||||
/*
|
||||
* set elr to NULL here since it has been inserted to
|
||||
* the request_list and the removal and free of it is
|
||||
* handled by ext4_clear_request_list from now on.
|
||||
*/
|
||||
elr = NULL;
|
||||
|
||||
if (!(ext4_li_info->li_state & EXT4_LAZYINIT_RUNNING)) {
|
||||
ret = ext4_run_lazyinit_thread();
|
||||
|
|
Loading…
Reference in New Issue