linux/drivers/block/drbd
Lars Ellenberg c12e9c8964 drbd: fix potential access after free
Occasionally, if we disconnect, we triggered this assert:
  block drbd7: ASSERT FAILED tl_hash[27] == c30b0f04, expected NULL

hlist_del() happens only on master bio completion.

We used to wait for pending IO to complete before freeing tl_hash
on disconnect. We no longer do so, since we learned to "freeze"
IO on disconnect.

If the local disk is too slow, we may reach C_STANDALONE early,
and there are still some requests pending locally when we call
drbd_free_tl_hash().

If we now free the tl_hash, and later the local IO completion completes
the master bio, which then does hlist_del() and clobbers freed memory.

Do hlist_del_init() and hlist_add_fake() before kfree(tl_hash),
so the hlist_del() on master bio completion is harmless.

Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
2012-07-24 14:15:16 +02:00
..
drbd_actlog.c drbd: differentiate between normal and forced detach 2012-07-24 14:06:18 +02:00
drbd_bitmap.c drbd: differentiate between normal and forced detach 2012-07-24 14:06:18 +02:00
drbd_int.h drbd: report congestion if we are waiting for some userland callback 2012-07-24 14:07:18 +02:00
drbd_main.c drbd: call local-io-error handler early 2012-07-24 14:10:41 +02:00
drbd_nl.c drbd: do not reset rs_pending_cnt too early 2012-07-24 14:09:53 +02:00
drbd_proc.c drbd: reset congestion information before reporting it in /proc/drbd 2012-07-24 14:07:48 +02:00
drbd_receiver.c drbd: fix potential access after free 2012-07-24 14:15:16 +02:00
drbd_req.c drbd: differentiate between normal and forced detach 2012-07-24 14:06:18 +02:00
drbd_req.h drbd: Immediately allow completion of IOs, that wait for IO completions on a failed disk 2012-05-09 10:16:04 +02:00
drbd_strings.c drbd: Rename enum drbd_state_ret_codes to enum drbd_state_rv 2011-03-10 11:36:18 +01:00
drbd_vli.h Fix common misspellings 2011-03-31 11:26:23 -03:00
drbd_worker.c drbd: do not reset rs_pending_cnt too early 2012-07-24 14:09:53 +02:00
drbd_wrappers.h drbd: Get rid of unnecessary macros (2) 2011-03-10 11:36:15 +01:00
Kconfig drbd: Kconfig fix 2009-12-29 17:38:28 +01:00
Makefile drbd: remove tracing bits 2009-10-01 21:17:58 +02:00