[Devel] [PATCH] Revert "ploop: Remove excess variable"

Kirill Tkhai ktkhai at virtuozzo.com
Mon Mar 25 19:08:07 MSK 2019


saved_ioc may be NULL. Then we increment the counter
and never decrement it. It even may overflow later.

https://jira.sw.ru/browse/PSBM-93006

Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
---
 drivers/block/ploop/dev.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/block/ploop/dev.c b/drivers/block/ploop/dev.c
index 1d6ee2329bb9..f8b9b0bcba78 100644
--- a/drivers/block/ploop/dev.c
+++ b/drivers/block/ploop/dev.c
@@ -2565,6 +2565,7 @@ static void ploop_req_state_process(struct ploop_request * preq)
 	struct ploop_device * plo = preq->plo;
 	struct ploop_delta * top_delta;
 	struct io_context * saved_ioc = NULL;
+	int release_ioc = 0;
 #ifdef CONFIG_BEANCOUNTERS
 	struct user_beancounter *saved_ub = NULL;
 #endif
@@ -2575,6 +2576,7 @@ static void ploop_req_state_process(struct ploop_request * preq)
 		saved_ioc = current->io_context;
 		current->io_context = preq->ioc;
 		atomic_long_inc(&preq->ioc->refcount);
+		release_ioc = 1;
 	}
 #ifdef CONFIG_BEANCOUNTERS
 	WARN_ONCE(!preq->preq_ub,
@@ -2906,7 +2908,7 @@ static void ploop_req_state_process(struct ploop_request * preq)
 		BUG();
 	}
 out:
-	if (saved_ioc) {
+	if (release_ioc) {
 		struct io_context * ioc = current->io_context;
 		current->io_context = saved_ioc;
 		put_io_context(ioc);



More information about the Devel mailing list