Commit:     177a99b23ef9878c0cedcc7273108eba8a6e9472
Parent:     a17184a911195c274104df98a79bec10f57e735d
Author:     NeilBrown <[EMAIL PROTECTED]>
AuthorDate: Wed Feb 6 01:39:56 2008 -0800
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Wed Feb 6 10:41:19 2008 -0800

    md: fix use-after-free bug when dropping an rdev from an md array
    Due to possible deadlock issues we need to use a schedule work to 
    an 'rdev' object from a different thread.
    A recent change means that kobject_add no longer gets a refernce, and
    kobject_del doesn't put a reference.  Consequently, we need to explicitly 
    a reference to ensure that the last reference isn't dropped before the
    scheduled work get a chance to call kobject_del.
    Also, rename delayed_delete to md_delayed_delete to that it is more obvious 
    a stack trace which code is to blame.
    Cc: Al Viro <[EMAIL PROTECTED]>
    Signed-off-by: Neil Brown <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
 drivers/md/md.c |    8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 08e0f8d..6cdd1b4 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1419,10 +1419,11 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, 
mddev_t * mddev)
        return err;
-static void delayed_delete(struct work_struct *ws)
+static void md_delayed_delete(struct work_struct *ws)
        mdk_rdev_t *rdev = container_of(ws, mdk_rdev_t, del_work);
+       kobject_put(&rdev->kobj);
 static void unbind_rdev_from_array(mdk_rdev_t * rdev)
@@ -1441,7 +1442,8 @@ static void unbind_rdev_from_array(mdk_rdev_t * rdev)
        /* We need to delay this, otherwise we can deadlock when
         * writing to 'remove' to "dev/state"
-       INIT_WORK(&rdev->del_work, delayed_delete);
+       INIT_WORK(&rdev->del_work, md_delayed_delete);
+       kobject_get(&rdev->kobj);
@@ -3686,7 +3688,7 @@ static int do_md_stop(mddev_t * mddev, int mode)
                                sysfs_remove_link(&mddev->kobj, nm);
-               /* make sure all delayed_delete calls have finished */
+               /* make sure all md_delayed_delete calls have finished */
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to