diff options
| author |   Mikulas Patocka <mpatocka@redhat.com> | 2015-07-10 17:21:43 -0400 |
|---|---|---|
| committer |   Mike Snitzer <snitzer@redhat.com> | 2015-07-13 09:14:11 -0400 |
| commit | b06075a98d595b761881fb2d7b8a557ea2f8b7ac (patch) | |
| tree | 0f4d62164e2204cd26af74f48bd1cb43e715aef1 /drivers/md/dm-cache-policy.c | |
| parent | Revert "dm: only run the queue on completion if congested or no requests pending" (diff) | |
| download | linux-dev-b06075a98d595b761881fb2d7b8a557ea2f8b7ac.tar.xz linux-dev-b06075a98d595b761881fb2d7b8a557ea2f8b7ac.zip | |
dm: fix use after free crash due to incorrect cleanup sequence
Linux 4.2-rc1 Commit 0f20972f7bf6 ("dm: factor out a common
cleanup_mapped_device()") moved a common cleanup code to a separate
function. Unfortunately, that commit incorrectly changed the order of
cleanup, so that it destroys the mapped_device's srcu structure
'io_barrier' before destroying its workqueue.
The function that is executed on the workqueue (dm_wq_work) uses the srcu
structure, thus it may use it after being freed. That results in a
crash in the LVM test suite's mirror-vgreduce-removemissing.sh test.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 0f20972f7bf6 ("dm: factor out a common cleanup_mapped_device()")
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Diffstat (limited to 'drivers/md/dm-cache-policy.c')
0 files changed, 0 insertions, 0 deletions