OSDN Git Service

dm snapshot: fix a possible invalid memory access on unload
authorMikulas Patocka <mpatocka@redhat.com>
Tue, 17 Feb 2015 19:34:00 +0000 (14:34 -0500)
committerMike Snitzer <snitzer@redhat.com>
Wed, 18 Feb 2015 14:41:54 +0000 (09:41 -0500)
commit22aa66a3ee5b61e0f4a0bfeabcaa567861109ec3
treeff93a13145102951cdc5302462175db52979ecdd
parent2bec1f4a8832e74ebbe859f176d8a9cb20dd97f4
dm snapshot: fix a possible invalid memory access on unload

When the snapshot target is unloaded, snapshot_dtr() waits until
pending_exceptions_count drops to zero.  Then, it destroys the snapshot.
Therefore, the function that decrements pending_exceptions_count
should not touch the snapshot structure after the decrement.

pending_complete() calls free_pending_exception(), which decrements
pending_exceptions_count, and then it performs up_write(&s->lock) and it
calls retry_origin_bios() which dereferences  s->origin.  These two
memory accesses to the fields of the snapshot may touch the dm_snapshot
struture after it is freed.

This patch moves the call to free_pending_exception() to the end of
pending_complete(), so that the snapshot will not be destroyed while
pending_complete() is in progress.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org
drivers/md/dm-snap.c