From: Igor Belousov mempool_resize() at some point has no valid elements array for a pool: ... kfree(pool->elements); /* here pool->elements is not valid */ pool->elements = new_elements; ... If e. g. mempool_alloc() tries to access pool->elements after kfree() but before the assignment that follows, we end up with an undefined behavior. Fix that by changing pool->elements to new_elements first and then freeing up the old array. Signed-off-by: Igor Belousov Signed-off-by: Vitaly Wool --- mm/mempool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/mempool.c b/mm/mempool.c index db23e0eef652..302d83cbeac1 100644 --- a/mm/mempool.c +++ b/mm/mempool.c @@ -384,8 +384,8 @@ int mempool_resize(struct mempool *pool, int new_min_nr) } memcpy(new_elements, pool->elements, pool->curr_nr * sizeof(*new_elements)); - kfree(pool->elements); - pool->elements = new_elements; + xchg(pool->elements, new_elements); + kfree(new_elements); pool->min_nr = new_min_nr; while (pool->curr_nr < pool->min_nr) { -- 2.39.2