From: Fabio Checconi Date: Thu, 10 Apr 2008 06:28:01 +0000 (+0200) Subject: cfq-iosched: do not leak ioc_data across iosched switches X-Git-Tag: v2.6.25-rc9~29^2 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4faa3c8150c1d4f7b38d962eda7851083e218e3f;p=pandora-kernel.git cfq-iosched: do not leak ioc_data across iosched switches When switching scheduler from cfq, cfq_exit_queue() does not clear ioc->ioc_data, leaving a dangling pointer that can deceive the following lookups when the iosched is switched back to cfq. The pattern that can trigger that is the following: - elevator switch from cfq to something else; - module unloading, with elv_unregister() that calls cfq_free_io_context() on ioc freeing the cic (via the .trim op); - module gets reloaded and the elevator switches back to cfq; - reallocation of a cic at the same address as before (with a valid key). To fix it just assign NULL to ioc_data in __cfq_exit_single_io_context(), that is called from the regular exit path and from the elevator switching code. The only path that frees a cic and is not covered is the error handling one, but cic's freed in this way are never cached in ioc_data. Signed-off-by: Fabio Checconi Signed-off-by: Jens Axboe --- Reading git-diff-tree failed