diff options
| author |   Dmitry Eremin <dmitry.eremin@intel.com> | 2013-07-23 00:06:31 +0800 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-07-23 12:39:24 -0700 |
| commit | 2080205729edf2a59296f17081c9aa25a7ed6368 (patch) | |
| tree | 21b2f25eb1f1c9a47d2aa040d9132521bdc01c2d /include/linux/timerqueue.h | |
| parent | staging/lustre/ldlm: print FID in lvbo_init(), lvbo_update (diff) | |
staging/lustre/ptlrpc: race in pinger (use-after-free situation)
The race is result of use-after-free situation:
~ ptlrpc_stop_pinger() ~ ptlrpc_pinger_main()
---------------------------------------------------------------
thread_set_flags(SVC_STOPPING)
cfs_waitq_signal(pinger_thread) ...
... thread_set_flags(SVC_STOPPED)
l_wait_event(thread_is_stopped)
OBD_FREE_PTR(pinger_thread)
... cfs_waitq_signal(pinger_thread)
---------------------------------------------------------------
The memory used by pinger_thread might have been freed and
reallocated to something else, when ptlrpc_pinger_main()
used it in cvs_waitq_signal().
Signed-off-by: Li Wei <wei.g.li@intel.com>
Signed-off-by: Dmitry Eremin <dmitry.eremin@intel.com>
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3032
Lustre-change: http://review.whamcloud.com/6040
Reviewed-by: Faccini Bruno <bruno.faccini@intel.com>
Reviewed-by: Mike Pershin <mike.pershin@intel.com>
Reviewed-by: Andreas Dilger <andreas.dilger@intel.com>
Signed-off-by: Peng Tao <tao.peng@emc.com>
Signed-off-by: Andreas Dilger <andreas.dilger@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/linux/timerqueue.h')
0 files changed, 0 insertions, 0 deletions