diff options
| author | NeilBrown <neilb@suse.de> | 2005-12-12 02:39:16 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-12-12 09:06:04 -0800 |
| commit | 3795bb0fc52fe2af2749f3ad2185cb9c90871ef8 (patch) | |
| tree | 764aa053d592b4ce555e2ca91077d7c6fc9eaa16 /drivers/md/raid1.c | |
| parent | 0de502aa44aae5712a18d471818d6c785e07c92e (diff) | |
| download | linux-3795bb0fc52fe2af2749f3ad2185cb9c90871ef8.tar.gz linux-3795bb0fc52fe2af2749f3ad2185cb9c90871ef8.tar.bz2 linux-3795bb0fc52fe2af2749f3ad2185cb9c90871ef8.zip | |
[PATCH] md: fix a use-after-free bug in raid1
Who would submit code with a FIXME like that in it !!!!
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/md/raid1.c')
| -rw-r--r-- | drivers/md/raid1.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 3066c587b539..229d7b204297 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -320,7 +320,6 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int * this branch is our 'one mirror IO has finished' event handler: */ r1_bio->bios[mirror] = NULL; - bio_put(bio); if (!uptodate) { md_error(r1_bio->mddev, conf->mirrors[mirror].rdev); /* an I/O failed, we can't clear the bitmap */ @@ -377,7 +376,6 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int } if (test_bit(R1BIO_BehindIO, &r1_bio->state)) { /* free extra copy of the data pages */ -/* FIXME bio has been freed!!! */ int i = bio->bi_vcnt; while (i--) __free_page(bio->bi_io_vec[i].bv_page); @@ -391,6 +389,9 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int raid_end_bio_io(r1_bio); } + if (r1_bio->bios[mirror]==NULL) + bio_put(bio); + rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev); return 0; } |