lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:	Thu, 21 Nov 2013 10:42:18 +0800
From:	YuLicheng <>
To:	<>
CC:	<>, <>
Subject: kref doc: Why kref kernel doc omits kref_put when kthread_run fail

The document is /Documentation/kerf.txt, and I'm referring to v3.12:

Part of the first example in the document is attached below.
In my_data_handler(), kref_init() already put 1 to refcount, and kref_get()
next made the refcount 2. But if kthread_run() fails, only one kref_put() 
take place (right after the out tag), it renders the refcount to be 1 at 
and the data will never be freed.

int my_data_handler(void)
        int rv = 0;
        struct my_data *data;
        struct task_struct *task;
        data = kmalloc(sizeof(*data), GFP_KERNEL);
        if (!data)
                return -ENOMEM;

        task = kthread_run(more_data_handling, data, "more_data_handling");
        if (task == ERR_PTR(-ENOMEM)) {
                rv = -ENOMEM;
                goto out;

        . do stuff with data here
        kref_put(&data->refcount, data_release);
        return rv;

I also noticed that there once was a kref_put() before "goto out" in the doc
before some point of 2009, but it was removed by a patch that claimed that 
kref_put() was redudent.
The patch commit is:

Is this a bug or maybe I missed something?


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists