On 2017年09月27日 17:40, Jan Kara wrote: On Wed 27-09-17 15:15:08, Zumeng Chen wrote: It seems kfree(new_congested) does nothing since new_congested has already been set null pointer before kfree, so remove it. Meanwhile kmemleak reports the following memory leakage: unreferenced object 0xcadbb440 (size 64): comm "kworker/0:4", pid 1399, jiffies 4294946504 (age 808.290s) hex dump (first 32 bytes): 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................ 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmem_cache_alloc_trace+0x2c4/0x3cc [] wb_congested_get_create+0x9c/0x140 [] wb_init+0x184/0x1f4 [] bdi_init+0x8c/0xd4 [] blk_alloc_queue_node+0x9c/0x2d8 [] blk_init_queue_node+0x2c/0x64 [] blk_init_queue+0x1c/0x20 [] __scsi_alloc_queue+0x28/0x44 [] scsi_alloc_queue+0x24/0x80 [] scsi_alloc_sdev+0x21c/0x34c [] scsi_probe_and_add_lun+0x878/0xb04 [] __scsi_scan_target+0x288/0x59c [] scsi_scan_channel+0x88/0x9c [] scsi_scan_host_selected+0x118/0x130 [] do_scsi_scan_host+0xa0/0xa4 [] scsi_scan_host+0x170/0x1b4 wb_congested allocates memory for congested when wb_congested_get_create, and release it when exit or failure by wb_congested_put. The patch is just wrong. Think what will happen if we decide to allocate new_congested but then loose a race with somebody creating the same congested structure (so we find it in the rb-tree). Honza Yes, indeed, the first caller has a chance to re-get a congested from rb tree when it has already gotten a kzalloc congested(At this time the lock has been released) So thanks Hon Signed-off-by: Zumeng Chen --- mm/backing-dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/backing-dev.c b/mm/backing-dev.c index e19606b..d816b2a 100644 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -457,6 +457,7 @@ wb_congested_get_create(struct backing_dev_info *bdi, int blkcg_id, gfp_t gfp) /* allocate storage for new one and retry */ new_congested = kzalloc(sizeof(*new_congested), gfp); + kmemleak_ignore(new_congested); if (!new_congested) return NULL; @@ -468,7 +469,6 @@ wb_congested_get_create(struct backing_dev_info *bdi, int blkcg_id, gfp_t gfp) found: atomic_inc(&congested->refcnt); spin_unlock_irqrestore(&cgwb_lock, flags); - kfree(new_congested); return congested; } -- 2.7.4