From: "Darrick J. Wong" <djwong@kernel.org>
To: Torsten Rupp <torsten.rupp@gmx.net>
Cc: linux-xfs@vger.kernel.org
Subject: Re: Double alloc/free of cache item
Date: Tue, 14 Oct 2025 10:24:42 -0700 [thread overview]
Message-ID: <20251014172442.GV6188@frogsfrogsfrogs> (raw)
In-Reply-To: <f45c9b48-eb0d-4314-aeb0-6b5e75c54a8e@gmx.net>
On Tue, Oct 14, 2025 at 08:51:12AM +0200, Torsten Rupp wrote:
> Dear XFS developers,
>
> there is a double alloc/free of the cache item "xfs_extfree_item_cache" in
> xfsprogs 6.16.0. If the environment variable LIBXFS_LEAK_CHECK is set this
> also cause a segmenation fault due to a NULL pointer access (the cache item
> is already freed). Please find attached a patch which fix this issue.
>
> I discussed this issue and the fix already with Darrick.
>
> Thank you for your work on xfsprogs!
>
> Best regards,
>
> Torsten
> From 4c669fd1db79564d8b5240c7464dd28f3bc27bb1 Mon Sep 17 00:00:00 2001
> From: Torsten Rupp <torsten.rupp@gmx.net>
> Date: Sun, 12 Oct 2025 09:23:58 +0200
> Subject: [PATCH 1/1] Fix alloc/free of cache item
>
> xfs_extfree_item_cache is allocated and freed twice. Remove the
> obsolete alloc/free.
>
> Signed-off-by: Torsten Rupp <torsten.rupp@gmx.net>
Usually patches are pasted inline in the message and not as attachments
to avoid picky MTAs, but whatever, it got through lore/vger.
Looks correct,
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
--D
> ---
> libxfs/init.c | 4 ----
> 1 file changed, 4 deletions(-)
>
> diff --git a/libxfs/init.c b/libxfs/init.c
> index 393a9467..a5e89853 100644
> --- a/libxfs/init.c
> +++ b/libxfs/init.c
> @@ -214,9 +214,6 @@ init_caches(void)
> fprintf(stderr, "Could not allocate btree cursor caches.\n");
> abort();
> }
> - xfs_extfree_item_cache = kmem_cache_init(
> - sizeof(struct xfs_extent_free_item),
> - "xfs_extfree_item");
> xfs_trans_cache = kmem_cache_init(
> sizeof(struct xfs_trans), "xfs_trans");
> xfs_parent_args_cache = kmem_cache_init(
> @@ -236,7 +233,6 @@ destroy_caches(void)
> leaked += kmem_cache_destroy(xfs_da_state_cache);
> xfs_defer_destroy_item_caches();
> xfs_btree_destroy_cur_caches();
> - leaked += kmem_cache_destroy(xfs_extfree_item_cache);
> leaked += kmem_cache_destroy(xfs_trans_cache);
> leaked += kmem_cache_destroy(xfs_parent_args_cache);
>
> --
> 2.43.0
>
prev parent reply other threads:[~2025-10-14 17:24 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <2yL7RbS2HGnFO9yJP_YwXFol0RVjGKEvff7qRCJ5j2GvAAVFpdm0cqPPChDkkjiOpcHrpqxRjPNTNhz36DxtxA==@protonmail.internalid>
2025-10-14 6:51 ` Double alloc/free of cache item Torsten Rupp
2025-10-14 7:27 ` Carlos Maiolino
2025-10-14 17:24 ` Darrick J. Wong [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251014172442.GV6188@frogsfrogsfrogs \
--to=djwong@kernel.org \
--cc=linux-xfs@vger.kernel.org \
--cc=torsten.rupp@gmx.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).