Re: [PATCH 002 of 6] md: Fix use-after-free bug when dropping an rdev from an md array.

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
To: Al Viro <viro@...>
Cc: Andrew Morton <akpm@...>, <linux-raid@...>, <linux-kernel@...>
Date: Monday, January 14, 2008 - 12:48 am

On Monday January 14, viro@ZenIV.linux.org.uk wrote:

well in -mm, rdev_attr_store gets a lock on
rdev->mddev->reconfig_mutex. 
It doesn't test is rdev->mddev is NULL though, so if the write happens
after unbind_rdev_from_array, we lose.
A test for NULL would be easy enough.  And I think that the mddev
won't actually disappear until the rdevs are all gone (you subsequent
comment about kobject_del ordering seems to confirm that) so a simple test
for NULL should be sufficient.


Probably not.  The possibility that rdev->mddev could be NULL would
break a lot of these.  Maybe I should delay setting rdev->mddev to
NULL until after the kobject_del.  Then audit them all.

Thanks.  I'll see what I can some up with.

NeilBrown
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
Re: [PATCH 002 of 6] md: Fix use-after-free bug when droppin..., Neil Brown, (Mon Jan 14, 12:48 am)