Am Mittwoch, 4. Juli 2007 schrieb Rusty Russell:
> +             vbr = mempool_alloc(vblk->pool, GFP_ATOMIC);
> +             if (!vbr)
> +                     goto stop;
[...]
> +             BUG_ON(req->nr_phys_segments > ARRAY_SIZE(vblk->sg));
> +             vbr->req = req;
> +             if (!do_req(q, vblk, vbr))
> +                     goto stop;
[...]
> +stop:
> +     /* Queue full?  Wait. */
> +     blk_stop_queue(q);
> +     mempool_free(vbr, vblk->pool);


Hmm, can mempool_free really handle NULL as its first argument? (first goto). 
As far as I can see we have a problem here. Our pool has preallocated 1 
element. So what about:
- first alloc fails in mempool_alloc fails -> we get the pre-allocated 
element, no more elements left
- second alloc fails in mempool_alloc fails -> we get NULL -> we return NULL 
to mempool_free which adds NULL back to the pool as the pool is empty. Now 
the pool has an NULL entry, no? 


Christian
_______________________________________________
Virtualization mailing list
[email protected]
https://lists.linux-foundation.org/mailman/listinfo/virtualization

Reply via email to