diff options
| author | Lars Ellenberg | 2010-09-05 01:13:24 +0200 |
|---|---|---|
| committer | Philipp Reisner | 2010-10-14 18:38:34 +0200 |
| commit | 1d53f09e170e477de67babd7a10e277479260d51 (patch) | |
| tree | c795de9e5aeaf8324eeb25ea20c7b94f573bca83 /drivers/block/drbd/drbd_worker.c | |
| parent | drbd: don't count sendpage()d pages only referenced by tcp as in use (diff) | |
| download | kernel-qcow2-linux-1d53f09e170e477de67babd7a10e277479260d51.tar.gz kernel-qcow2-linux-1d53f09e170e477de67babd7a10e277479260d51.tar.xz kernel-qcow2-linux-1d53f09e170e477de67babd7a10e277479260d51.zip | |
drbd: fix potential kernel BUG (NULL deref)
BUG trace would look like:
lc_find
drbd_rs_complete_io
got_OVResult
drbd_asender
Could be triggered by explicit, or IO-error policy based,
detach during online-verify.
We may only dereference mdev->resync, if we first get_ldev(), as the
disk may break any time, causing mdev->resync to disappear once all
ldev references have been returned.
Already in flight online-verify requests or replies may still come in,
which we then need to ignore.
Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Diffstat (limited to 'drivers/block/drbd/drbd_worker.c')
| -rw-r--r-- | drivers/block/drbd/drbd_worker.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/block/drbd/drbd_worker.c b/drivers/block/drbd/drbd_worker.c index 01743193f321..c72a5fc1c88e 100644 --- a/drivers/block/drbd/drbd_worker.c +++ b/drivers/block/drbd/drbd_worker.c @@ -1027,7 +1027,10 @@ int w_e_end_csum_rs_req(struct drbd_conf *mdev, struct drbd_work *w, int cancel) return 1; } - drbd_rs_complete_io(mdev, e->sector); + if (get_ldev(mdev)) { + drbd_rs_complete_io(mdev, e->sector); + put_ldev(mdev); + } di = e->digest; @@ -1134,7 +1137,10 @@ int w_e_end_ov_reply(struct drbd_conf *mdev, struct drbd_work *w, int cancel) /* after "cancel", because after drbd_disconnect/drbd_rs_cancel_all * the resync lru has been cleaned up already */ - drbd_rs_complete_io(mdev, e->sector); + if (get_ldev(mdev)) { + drbd_rs_complete_io(mdev, e->sector); + put_ldev(mdev); + } di = e->digest; |