On Wed, 23 Apr 2008 10:34:57 +0300, "Pekka Enberg" <penberg@cs.helsinki.fi> wrote:
quoted text
> On Wed, Apr 23, 2008 at 10:31 AM, Pekka Enberg <penberg@cs.helsinki.fi> wrote:
> >  On Wed, Apr 23, 2008 at 9:51 AM, Pete Zaitcev <zaitcev@redhat.com> wrote:

quoted text
> >  >  I looked at this whole day today, but found nothing.
> >  >
> >  >  The code analysis for usbmon shows nothing. Anyone wants to have
> >  >  a look?
> 
> >  I didn't look too closely but mon_text_fetch() does list_del() but no
> >  kmem_cache_free() which looks fishy.
> 
> Yup, looks like a leak in the error path. So it's mon_text_read_t() ->
> mon_text_read_wait() -> mon_text_fetch() that removes it from the list
> but we can fail before we reach the kmem_cache_free() in
> mon_text_read_t() and thus lose track of the object.

This is false, we cannot fail. There's only one "return" for non-NULL
case and the kmem_cache_free is right in front of it. See my reply
to the patch.

-- Pete
--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/