From: Lars Ellenberg Date: Tue, 19 Jun 2012 07:40:00 +0000 (+0200) Subject: drbd: fix potential access after free X-Git-Tag: v3.6-rc1~6^2~9^2~3 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c12e9c8964215aaf2b5dcd06048444c2b672f0b9;p=pandora-kernel.git drbd: fix potential access after free Occasionally, if we disconnect, we triggered this assert: block drbd7: ASSERT FAILED tl_hash[27] == c30b0f04, expected NULL hlist_del() happens only on master bio completion. We used to wait for pending IO to complete before freeing tl_hash on disconnect. We no longer do so, since we learned to "freeze" IO on disconnect. If the local disk is too slow, we may reach C_STANDALONE early, and there are still some requests pending locally when we call drbd_free_tl_hash(). If we now free the tl_hash, and later the local IO completion completes the master bio, which then does hlist_del() and clobbers freed memory. Do hlist_del_init() and hlist_add_fake() before kfree(tl_hash), so the hlist_del() on master bio completion is harmless. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg --- Reading git-diff-tree failed