]> git.karo-electronics.de Git - karo-tx-linux.git/commit
md/raid1,10: Remove use-after-free bug in make_request.
authorNeilBrown <neilb@suse.de>
Tue, 6 Sep 2011 01:45:55 +0000 (11:45 +1000)
committerNeilBrown <neilb@suse.de>
Tue, 6 Sep 2011 01:45:55 +0000 (11:45 +1000)
commit7485fc1e485b3dca113373ca86155a61eb2982c8
treea0f8ef6935d9eb26688cd4fc3d357103d5d1aa05
parentaf06bd9e6eb82e7d9f096f6ceeb2f00911042c9d
md/raid1,10: Remove use-after-free bug in make_request.

A single request to RAID1 or RAID10 might result in multiple
requests if there are known bad blocks that need to be avoided.

To detect if we need to submit another write request we test:
  if (sectors_handled < (bio->bi_size >> 9)) {

However this is after we call **_write_done() so the 'bio' no longer
belongs to us - the writes could have completed and the bio freed.

So move the **_write_done call until after the test against
bio->bi_size.

This addresses https://bugzilla.kernel.org/show_bug.cgi?id=41862

Reported-by: Bruno Wolff III <bruno@wolff.to>
Signed-off-by: NeilBrown <neilb@suse.de>
drivers/md/raid1.c
drivers/md/raid10.c