From: NeilBrown <neilb@suse.de>
Date: Wed, 6 Feb 2008 09:39:56 +0000 (-0800)
Subject: md: fix use-after-free bug when dropping an rdev from an md array
X-Git-Tag: v2.6.25-rc1~547
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=177a99b23ef9878c0cedcc7273108eba8a6e9472;p=pandora-kernel.git

md: fix use-after-free bug when dropping an rdev from an md array

Due to possible deadlock issues we need to use a schedule work to kobject_del
an 'rdev' object from a different thread.

A recent change means that kobject_add no longer gets a refernce, and
kobject_del doesn't put a reference.  Consequently, we need to explicitly hold
a reference to ensure that the last reference isn't dropped before the
scheduled work get a chance to call kobject_del.

Also, rename delayed_delete to md_delayed_delete to that it is more obvious in
a stack trace which code is to blame.

Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

Reading git-diff-tree failed