On Wed, 14 April 2010 17:56:10 -0700, Kevin Cernekee wrote:
quoted text
> 
> logfs_kill_sb() calls mempool_destroy() on super->s_alias_pool .  But if
> logfs_kill_sb() is being called because the mount failed (e.g.
> __logfs_read_sb() returned -EIO) this pointer will still be NULL,
> resulting in a kernel oops.
> 
> Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
> ---
>  fs/logfs/super.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 
> diff --git a/fs/logfs/super.c b/fs/logfs/super.c
> index b60bfac..f817713 100644
> --- a/fs/logfs/super.c
> +++ b/fs/logfs/super.c
> @@ -517,7 +517,8 @@ static void logfs_kill_sb(struct super_block *sb)
>  		__free_page(super->s_erase_page);
>  	super->s_devops->put_device(sb);
>  	mempool_destroy(super->s_btree_pool);
> -	mempool_destroy(super->s_alias_pool);
> +	if (super->s_alias_pool)
> +		mempool_destroy(super->s_alias_pool);
>  	kfree(super);
>  	log_super("LogFS: Finished unmounting\n");
>  }

That shouldn't have happened.  I fixed this bug in a patch from almost
exactly one month ago.  But when moving patches from a test tree, this
one patch got lost.  Added to my release tree now - finally:

git://git.kernel.org/pub/scm/linux/kernel/git/joern/logfs.git

Sorry that you had to step into that turd and thank you for shoving my
nose into it.  I'll try to be a good dog and not do it again.

Jörn

-- 
When you close your hand, you own nothing. When you open it up, you
own the whole world.
-- Li Mu Bai in Tiger & Dragon
--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/