Re: Slab corruption in floppy driver module

[Dirk Gouders <gouders@et.bocholt.fh-gelsenkirchen.de>]

Tejun Heo <tj@kernel.org> writes:

> Hello,
>
> On Thu, Jan 26, 2012 at 10:04:20AM -0500, Vivek Goyal wrote:
>>  out_put_disk:
>>  	while (dr--) {
>>  		del_timer_sync(&motor_off_timer[dr]);
>> -		if (disks[dr]->queue)
>> +		if (disks[dr]->queue) {
>>  			blk_cleanup_queue(disks[dr]->queue);
>> +			/*
>> +			 * The request queue reference we took at device
>> +			 * creation time has been put by above
>> +			 * blk_cleanup_queue(). We have not called add_disk()
>> +			 * yet and due to failure calling put_disk(). Put disk
>> +			 * will try to put a reference to disk->queue which is
>> +			 * taken in add_disk(). As we have not taken that
>> +			 * extra reference, putting extra reference down
>> +			 * will try to access already freed queue. Clear
>> +			 * disk->queue before calling put_disk().
>> +			 */
>> +			disks[dr]->queue = NULL;
>
> Yeah, this looks correct to me.  It might be better to tone down the
> comment a bit tho.  Wouldn't it be sufficient to say put_disk() isn't
> paired with add_disk() and will put one extra time?

I tested the patch on my machine without a floppy controller and
it no longer produces traces, just "floppy0: no floppy controllers
found"

Dirk