block: fix double-free in the failure path of cgwb_bdi_init()

[linux-beck.git] / mm / backing-dev.c

diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 8fde443f36d778ffae9e66643387575ce7be9307..6ff2d7744223b7c92a07b7a5ea1324992810387c 100644 (file)
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -757,15 +757,20 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
        if (!bdi->wb_congested)
                return -ENOMEM;
 
+       atomic_set(&bdi->wb_congested->refcnt, 1);
+
        err = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
        if (err) {
-               kfree(bdi->wb_congested);
+               wb_congested_put(bdi->wb_congested);
                return err;
        }
        return 0;
 }
 
-static void cgwb_bdi_destroy(struct backing_dev_info *bdi) { }
+static void cgwb_bdi_destroy(struct backing_dev_info *bdi)
+{
+       wb_congested_put(bdi->wb_congested);
+}
 
 #endif /* CONFIG_CGROUP_WRITEBACK */