logfs_kill_sb() calls mempool_destroy() on super->s_alias_pool .  But if
logfs_kill_sb() is being called because the mount failed (e.g.
__logfs_read_sb() returned -EIO) this pointer will still be NULL,
resulting in a kernel oops.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
---
 fs/logfs/super.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/fs/logfs/super.c b/fs/logfs/super.c
index b60bfac..f817713 100644
--- a/fs/logfs/super.c
+++ b/fs/logfs/super.c
@@ -517,7 +517,8 @@ static void logfs_kill_sb(struct super_block *sb)
 		__free_page(super->s_erase_page);
 	super->s_devops->put_device(sb);
 	mempool_destroy(super->s_btree_pool);
-	mempool_destroy(super->s_alias_pool);
+	if (super->s_alias_pool)
+		mempool_destroy(super->s_alias_pool);
 	kfree(super);
 	log_super("LogFS: Finished unmounting\n");
 }
-- 
1.6.3.1

--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/