]> git.neil.brown.name Git - md.git/commit
git / md.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 09c9b8d) | patch
raid5-cache: fix a user-after-free bug
authorShaohua Li <shli@fb.com>
Wed, 2 Sep 2015 20:49:47 +0000 (13:49 -0700)
committerNeilBrown <neilb@suse.com>
Thu, 22 Oct 2015 05:17:56 +0000 (16:17 +1100)
commit03f15153f6cd12bfc1fac814a10303ecc52d2080
tree4ce9352b1d73cf303090b28073ac2c537295b7a8tree | snapshot
parent09c9b8d41a8e7157edfb94977160e035a6f10b8dcommit | diff
raid5-cache: fix a user-after-free bug

r5l_compress_stripe_end_list() can free an io_unit. This breaks the
assumption only reclaimer can free io_unit. We can add a reference count
based io_unit free, but since only reclaim can wait io_unit becoming to
STRIPE_END state, we use a simple global wait queue here.

Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: NeilBrown <neilb@suse.com>
drivers/md/raid5-cache.c diff | blob | history
Linux 2.6 with md patches