• Al Viro's avatar
    percpu_ref_init(): clean ->percpu_count_ref on failure · a9171431
    Al Viro authored
    That way percpu_ref_exit() is safe after failing percpu_ref_init().
    At least one user (cgroup_create()) had a double-free that way;
    there might be other similar bugs.  Easier to fix in percpu_ref_init(),
    rather than playing whack-a-mole in sloppy users...
    
    Usual symptoms look like a messed refcounting in one of subsystems
    that use percpu allocations (might be percpu-refcount, might be
    something else).  Having refcounts for two different objects share
    memory is Not Nice(tm)...
    
    Reported-by: syzbot+5b1e53987f858500ec00@syzkaller.appspotmail.com
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    a9171431
percpu-refcount.c 15.3 KB