user warning: Got error 28 from storage engine query: SELECT t.*,v.weight AS v_weight_unused FROM term_node r INNER JOIN term_data t ON r.tid = t.tid INNER JOIN vocabulary v ON t.vid = v.vid WHERE r.vid = 109 ORDER BY v.weight, t.weight, in /opt/drupal-6.33/modules/taxonomy/taxonomy.module on line 640.


Issue of the Implementation # K0002


(ext4) Calling kfree for uninitialized pointer in ext4_mb_init_backend

Detailed Description

At fs/ext4/mballoc.c:2389, memory is allocated for sbi->s_group_info array. The elements of this array (pointers themselves) are initialized when ext4_mb_add_groupinfo() is called (line 2408).

If ext4_mb_add_groupinfo() fails for some reason (e.g. if memory allocation at line 2296 fails), ext4_mb_init_backend() tries to call kfree() for each element in sbi->s_group_info array, including the ones that have not been initialized yet (fs/ext4/mballoc.c:2414):

    cachep = get_groupinfo_cache(sb->s_blocksize_bits);
    while (i-- > 0)
        kmem_cache_free(cachep, ext4_get_group_info(sb, i));
    i = num_meta_group_infos; 
    while (i-- > 0)
        kfree(sbi->s_group_info[i]); /* <= oops here */

The problem showed up when the tests for ext4 from Linux Test Project (ext4-alloc-test, test #7, to be exact) were running.

'num_meta_group_infos' (the number of elements in the array) was 12. The first 2 calls to ext4_mb_add_groupinfo() (ln 2408) succeeded but the 3rd one failed.

kfree(sbi->s_group_info[11]) resulted in a kernel oops

Possible solutions

- sbi->s_group_info = kmalloc(array_size, GFP_KERNEL);
+ sbi->s_group_info = kzalloc(array_size, GFP_KERNEL);


linux-kernel 2.6.38


Problems found by KEDR


Kernel Bug Tracker, bug #30872


Fixed in the kernel 2.6.39-rc1