Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c9a78332 authored by Slava Pestov's avatar Slava Pestov Committed by Kent Overstreet
Browse files

bcache: fix memory corruption in init error path 

If register_cache_set() failed, we would touch ca->set after
it had already been freed. Also, fix an assertion to catch
this.

Change-Id: I748e5f5b223e2d9b2602075dec2f997cced2394d
parent bf0c55c9

drivers/md/bcache/super.c

+8 −3
Original line number Diff line number Diff line
@@ -1356,8 +1356,11 @@ static void cache_set_free(struct closure *cl) 
	bch_journal_free(c);



	for_each_cache(ca, c, i)

		if (ca)

		if (ca) {

			ca->set = NULL;

			c->cache[ca->sb.nr_this_dev] = NULL;

			kobject_put(&ca->kobj);

		}



	bch_bset_sort_state_free(&c->sort);

	free_pages((unsigned long) c->uuids, ilog2(bucket_pages(c)));
@@ -1794,8 +1797,10 @@ void bch_cache_release(struct kobject *kobj) 
	struct cache *ca = container_of(kobj, struct cache, kobj);

	unsigned i;



	if (ca->set)

	if (ca->set) {

		BUG_ON(ca->set->cache[ca->sb.nr_this_dev] != ca);

		ca->set->cache[ca->sb.nr_this_dev] = NULL;

	}



	bio_split_pool_free(&ca->bio_split_hook);