Re: [PATCH] block: fix double-free in the failure path of cgwb_bdi_init()

[Jens Axboe]

On 02/08/2017 01:19 PM, Tejun Heo wrote:
> When !CONFIG_CGROUP_WRITEBACK, bdi has single bdi_writeback_congested
> at bdi->wb_congested.  cgwb_bdi_init() allocates it with kzalloc() and
> doesn't do further initialization.  This usually works fine as the
> reference count gets bumped to 1 by wb_init() and the put from
> wb_exit() releases it.
> 
> However, when wb_init() fails, it puts the wb base ref automatically
> freeing the wb and the explicit kfree() in cgwb_bdi_init() error path
> ends up trying to free the same pointer the second time causing a
> double-free.
> 
> Fix it by explicitly initilizing the refcnt to 1 and putting the base
> ref from cgwb_bdi_destroy().

Queued up for 4.11.

-- 
Jens Axboe