diff options
| author | Seth Jennings <sjenning@linux.vnet.ibm.com> | 2011-10-06 19:28:26 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-10-11 16:02:49 (GMT) |
| commit | 8550be08cbed164a8357491cc2c27cb99282b7ff (patch) | |
| tree | 7789ba18010eb7d1338e488dfe7a0754b093c3ba | |
| parent | 5ba321cf175192259ea0b3cc2322986cf1194fee (diff) | |
| download | linux-fsl-qoriq-8550be08cbed164a8357491cc2c27cb99282b7ff.tar.xz | |
staging: zcache: fix crash on cpu remove
In the case that a cpu is taken offline before zcache_do_preload() is
ever called on the cpu, the per-cpu zcache_preloads structure will
be uninitialized. In the CPU_DEAD case for zcache_cpu_notifier(),
kp->obj is not checked before calling kmem_cache_free() on it.
If it is NULL, a crash results.
This patch ensures that both kp->obj and kp->page are not NULL before
calling the respective free functions. In practice, just checking
one or the other should be sufficient since they are assigned together
in zcache_do_preload(), but I check both for safety.
Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Acked-by: Dave Hansen <dave@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/staging/zcache/zcache-main.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c index fbb4001..dae2f4e 100644 --- a/drivers/staging/zcache/zcache-main.c +++ b/drivers/staging/zcache/zcache-main.c @@ -1357,8 +1357,14 @@ static int zcache_cpu_notifier(struct notifier_block *nb, kp->objnodes[kp->nr - 1] = NULL; kp->nr--; } - kmem_cache_free(zcache_obj_cache, kp->obj); - free_page((unsigned long)kp->page); + if (kp->obj) { + kmem_cache_free(zcache_obj_cache, kp->obj); + kp->obj = NULL; + } + if (kp->page) { + free_page((unsigned long)kp->page); + kp->page = NULL; + } break; default: break; |