diff options
author | Eric Sandeen <sandeen@redhat.com> | 2014-04-17 08:15:28 +1000 |
---|---|---|
committer | Dave Chinner <david@fromorbit.com> | 2014-04-17 08:15:28 +1000 |
commit | 8d6c121018bf60d631c05a4a2efc468a392b97bb (patch) | |
tree | c4ba5841856012c71b55eb0ab281f42cb44e9c0e /fs/xfs/xfs_inode.h | |
parent | 07d5035a289f8bebe0ea86c293b2d5412478c481 (diff) | |
download | op-kernel-dev-8d6c121018bf60d631c05a4a2efc468a392b97bb.zip op-kernel-dev-8d6c121018bf60d631c05a4a2efc468a392b97bb.tar.gz |
xfs: fix buffer use after free on IO error
When testing exhaustion of dm snapshots, the following appeared
with CONFIG_DEBUG_OBJECTS_FREE enabled:
ODEBUG: free active (active state 0) object type: work_struct hint: xfs_buf_iodone_work+0x0/0x1d0 [xfs]
indicating that we'd freed a buffer which still had a pending reference,
down this path:
[ 190.867975] [<ffffffff8133e6fb>] debug_check_no_obj_freed+0x22b/0x270
[ 190.880820] [<ffffffff811da1d0>] kmem_cache_free+0xd0/0x370
[ 190.892615] [<ffffffffa02c5924>] xfs_buf_free+0xe4/0x210 [xfs]
[ 190.905629] [<ffffffffa02c6167>] xfs_buf_rele+0xe7/0x270 [xfs]
[ 190.911770] [<ffffffffa034c826>] xfs_trans_read_buf_map+0x7b6/0xac0 [xfs]
At issue is the fact that if IO fails in xfs_buf_iorequest,
we'll queue completion unconditionally, and then call
xfs_buf_rele; but if IO failed, there are no IOs remaining,
and xfs_buf_rele will free the bp while work is still queued.
Fix this by not scheduling completion if the buffer has
an error on it; run it immediately. The rest is only comment
changes.
Thanks to dchinner for spotting the root cause.
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Diffstat (limited to 'fs/xfs/xfs_inode.h')
0 files changed, 0 insertions, 0 deletions