Re: [BUG] It seems that i found a bug in the linux kernel, and it also in the newest kernel version

Re: [BUG] It seems that i found a bug in the linux kernel, and it also in the newest kernel version

[eagle black]

On Fri, Dec 26, 2008 at 3:15 PM, eagle black <rochacker@gmail.com> wrote:
>
> let's see, int the function elevator_init of block/elevator.c ,
> if the function elevator_init_queue failed for some reason, and the memory
> of elevator_alloc  alloced does not free!
>
> int elevator_init(struct request_queue *q, char *name)
> {
>         struct elevator_type *e = NULL;
>         struct elevator_queue *eq;
>         int ret = 0;
>         void *data;
>
>         INIT_LIST_HEAD(&q->queue_head);
>         q->last_merge = NULL;
>         q->end_sector = 0;
>         q->boundary_rq = NULL;
>
>         if (name) {
>                 e = elevator_get(name);
>                 if (!e)
>                         return -EINVAL;
>         }
>
>         if (!e && *chosen_elevator) {
>                 e = elevator_get(chosen_elevator);
>                 if (!e)
>                         printk(KERN_ERR "I/O scheduler %s not found\n",
>                                                         chosen_elevator);
>         }
>
>         if (!e) {
>                 e = elevator_get(CONFIG_DEFAULT_IOSCHED);
>                 if (!e) {
>                         printk(KERN_ERR
>                                 "Default I/O scheduler not found. " \
>                                 "Using noop.\n");
>                         e = elevator_get("noop");
>                 }
>         }
>
>         eq = elevator_alloc(q, e);
>         if (!eq)
>                 return -ENOMEM;
>
>         data = elevator_init_queue(q, eq);
>         if (!data) {
>                 kobject_put(&eq->kobj);
>                 return -ENOMEM;
>         }
>
>         elevator_attach(q, eq, data);
>         return ret;
> }
> EXPORT_SYMBOL(elevator_init);
>

Re: [BUG] It seems that i found a bug in the linux kernel, and it also in the newest kernel version

[Jens Axboe]

On Fri, Dec 26 2008, eagle black wrote:
> let's see, int the function elevator_init of block/elevator.c ,
> if the function elevator_init_queue failed for some reason, and the memory
> of elevator_alloc  alloced does not free!
> 
> int elevator_init(struct request_queue *q, char *name)
> {
>         struct elevator_type *e = NULL;
>         struct elevator_queue *eq;
>         int ret = 0;
>         void *data;
> 
>         INIT_LIST_HEAD(&q->queue_head);
>         q->last_merge = NULL;
>         q->end_sector = 0;
>         q->boundary_rq = NULL;
> 
>         if (name) {
>                 e = elevator_get(name);
>                 if (!e)
>                         return -EINVAL;
>         }
> 
>         if (!e && *chosen_elevator) {
>                 e = elevator_get(chosen_elevator);
>                 if (!e)
>                         printk(KERN_ERR "I/O scheduler %s not found\n",
>                                                         chosen_elevator);
>         }
> 
>         if (!e) {
>                 e = elevator_get(CONFIG_DEFAULT_IOSCHED);
>                 if (!e) {
>                         printk(KERN_ERR
>                                 "Default I/O scheduler not found. " \
>                                 "Using noop.\n");
>                         e = elevator_get("noop");
>                 }
>         }
> 
>         eq = elevator_alloc(q, e);
>         if (!eq)
>                 return -ENOMEM;
> 
>         data = elevator_init_queue(q, eq);
>         if (!data) {
>                 kobject_put(&eq->kobj);

See the kobject_put() there. It'll put the one and only reference to
this kobject, which wil end up in elevator_release() that then frees
'eq' (called 'e' there).

-- 
Jens Axboe