lkml.org 
[lkml]   [2010]   [Oct]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[GIT PULL] Throtl bug (was Re: [origin tree boot failure] Re: [GIT PULL] core block bits for 2.6.37-rc1)
On 2010-10-23 20:21, Ingo Molnar wrote:
>
> * Jens Axboe <jaxboe@fusionio.com> wrote:
>
>>> Looks like a fairly straight forward case of uninitialized memory and
>>> blk_sync_queue() -> throtl_shutdown_timer() -> cancel_delayed_work_sync().
>>>
>>> Will get that fixed up.
>>
>> It frees q->td in blk_cleanup_queue(), but doesn't clear q->td. When the final put
>> happens, blk_sync_queue() is called and then ends up doing the
>> cancel_delayed_work_sync() on freed memory.
>>
>> Two possible fixes:
>>
>> - Clear ->td when the queue is goin dead. May require other ->td == NULL
>> checks in the code, so I opted for:
>>
>> - Move the free to when the queue is really going away, post doing the
>> blk_sync_queue() call.
>>
>> The below should fix it.
>>
>> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
>
> This did the trick, thanks Jens!

Great, thanks for testing/reporting! I added your reported/tested-by.

Linus, please pull this single fix, better get this out the door since
I'll be travelling very shortly.


git://git.kernel.dk/linux-2.6-block.git for-2.6.37/core

Jens Axboe (1):
block: fix use-after-free bug in blk throttle code

block/blk-core.c | 2 --
block/blk-sysfs.c | 2 ++
2 files changed, 2 insertions(+), 2 deletions(-)

--
Jens Axboe



\
 
 \ /
  Last update: 2010-10-23 20:47    [W:0.101 / U:0.276 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site