diff options
| author |   Al Viro <viro@zeniv.linux.org.uk> | 2022-05-18 02:13:40 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2022-05-18 02:20:17 -0400 |
| commit | a91714312eb16f9ecd1f7f8b3efe1380075f28d4 (patch) | |
| tree | 05ca2e6cf5a7d10291af1bdf2dc7bd164e85a234 /scripts/generate_rust_analyzer.py | |
| parent | Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost (diff) | |
| download | wireguard-linux-a91714312eb16f9ecd1f7f8b3efe1380075f28d4.tar.xz wireguard-linux-a91714312eb16f9ecd1f7f8b3efe1380075f28d4.zip | |
percpu_ref_init(): clean ->percpu_count_ref on failure
That way percpu_ref_exit() is safe after failing percpu_ref_init().
At least one user (cgroup_create()) had a double-free that way;
there might be other similar bugs. Easier to fix in percpu_ref_init(),
rather than playing whack-a-mole in sloppy users...
Usual symptoms look like a messed refcounting in one of subsystems
that use percpu allocations (might be percpu-refcount, might be
something else). Having refcounts for two different objects share
memory is Not Nice(tm)...
Reported-by: syzbot+5b1e53987f858500ec00@syzkaller.appspotmail.com
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'scripts/generate_rust_analyzer.py')
0 files changed, 0 insertions, 0 deletions