From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeff Moyer Subject: Re: [PATCH 3/8] cfq-iosched: fix oom cfq_queue ref leak in cfq_set_request() Date: Mon, 08 Jun 2015 14:51:39 -0400 Message-ID: References: <1433753973-23684-1-git-send-email-tj@kernel.org> <1433753973-23684-4-git-send-email-tj@kernel.org> Mime-Version: 1.0 Return-path: In-Reply-To: <1433753973-23684-4-git-send-email-tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> (Tejun Heo's message of "Mon, 8 Jun 2015 17:59:28 +0900") Sender: cgroups-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Tejun Heo Cc: axboe-tSWWG44O7X1aa/9Udqfwiw@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, vgoyal-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, avanzini.arianna-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org Tejun Heo writes: > If the cfq_queue cached in cfq_io_cq is the oom one, cfq_set_request() > replaces it by invoking cfq_get_queue() again without putting the oom > queue leaking the reference it was holding. While oom queues are not > released through reference counting, they're still reference counted > and this can theoretically lead to the reference count overflowing and > incorrectly invoke the usual release path on it. > > Fix it by making cfq_set_request() put the ref it was holding. > > Signed-off-by: Tejun Heo > Cc: Vivek Goyal > Cc: Arianna Avanzini Reviewed-by: Jeff Moyer