Author: jhibbits Date: Tue Feb 13 17:40:09 2018 New Revision: 329225 URL: https://svnweb.freebsd.org/changeset/base/329225
Log: Narrow a race, and fix a leak, in g_part_wither A race in g_part_wither() can lead to I/O being performed with a freed GEOM when the device disappears. Close the race as best as we can for now, following the code patterns from g_part_ctl_destroy() and g_part_ctl_undo(). This also fixes a leak, as g_wither_geom() does not wither providers, it only orphans them, so the partition entries would never get destroyed in g_wither_washer(). Note, this is not a complete fix, it can still race with g_part_start(), the race has merely been narrowed. Reviewed by: markj Sponsored by: Dell EMC Isilon Modified: head/sys/geom/part/g_part.c Modified: head/sys/geom/part/g_part.c ============================================================================== --- head/sys/geom/part/g_part.c Tue Feb 13 17:38:08 2018 (r329224) +++ head/sys/geom/part/g_part.c Tue Feb 13 17:40:09 2018 (r329225) @@ -1541,18 +1541,21 @@ g_part_wither(struct g_geom *gp, int error) { struct g_part_entry *entry; struct g_part_table *table; + struct g_provider *pp; table = gp->softc; if (table != NULL) { - G_PART_DESTROY(table, NULL); + gp->softc = NULL; while ((entry = LIST_FIRST(&table->gpt_entry)) != NULL) { LIST_REMOVE(entry, gpe_entry); + pp = entry->gpe_pp; + entry->gpe_pp->private = NULL; + entry->gpe_pp = NULL; + g_wither_provider(pp, error); g_free(entry); } - if (gp->softc != NULL) { - kobj_delete((kobj_t)gp->softc, M_GEOM); - gp->softc = NULL; - } + G_PART_DESTROY(table, NULL); + kobj_delete((kobj_t)table, M_GEOM); } g_wither_geom(gp, error); } _______________________________________________ svn-src-all@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"