From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat, 18 Mar 2006 18:50:00 +0000 (-0500)
Subject: [PATCH] fix double-free in blk_init_queue_node()
X-Git-Tag: v2.6.17-rc1~1187^2~17
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8669aafdb5a46a57366dd1540fc475544071a9c9;p=linux-2.6

[PATCH] fix double-free in blk_init_queue_node()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index 0ef2971a9e..5fac138a5b 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -1854,8 +1854,10 @@ blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)
 		return NULL;
 
 	q->node = node_id;
-	if (blk_init_free_list(q))
-		goto out_init;
+	if (blk_init_free_list(q)) {
+		kmem_cache_free(requestq_cachep, q);
+		return NULL;
+	}
 
 	/*
 	 * if caller didn't supply a lock, they get per-queue locking with
@@ -1891,9 +1893,7 @@ blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)
 		return q;
 	}
 
-	blk_cleanup_queue(q);
-out_init:
-	kmem_cache_free(requestq_cachep, q);
+	blk_put_queue(q);
 	return NULL;
 }
 EXPORT_SYMBOL(blk_init_queue_node);