* Jens Axboe <jaxboe@fusionio.com> wrote:

quoted text
> > Looks like a fairly straight forward case of uninitialized memory and 
> > blk_sync_queue() -> throtl_shutdown_timer() -> cancel_delayed_work_sync().
> > 
> > Will get that fixed up.
> 
> It frees q->td in blk_cleanup_queue(), but doesn't clear q->td. When the final put 
> happens, blk_sync_queue() is called and then ends up doing the 
> cancel_delayed_work_sync() on freed memory.
> 
> Two possible fixes:
> 
> - Clear ->td when the queue is goin dead. May require other ->td == NULL
>   checks in the code, so I opted for:
> 
> - Move the free to when the queue is really going away, post doing the
>   blk_sync_queue() call.
> 
> The below should fix it.
> 
> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>

This did the trick, thanks Jens!

Tested-by: Ingo Molnar <mingo@elte.hu>

	Ingo
--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/