| From stable-bounces@linux.kernel.org  Tue Dec  5 07:16:43 2006 | 
 | Message-ID: <45758C16.5010905@redhat.com> | 
 | Date: Tue, 05 Dec 2006 16:11:18 +0100 | 
 | From: Milan Broz <mbroz@redhat.com> | 
 | To: stable@kernel.org | 
 | Cc: device-mapper development <dm-devel@redhat.com>, Alasdair G Kergon <agk@redhat.com> | 
 | Subject: dm snapshot: fix freeing pending exception | 
 |  | 
 | Fix oops when removing full snapshot | 
 | kernel bugzilla bug 7040 | 
 |  | 
 | If a snapshot became invalid (full) while there is outstanding  | 
 | pending_exception, pending_complete() forgets to remove | 
 | the corresponding exception from its exception table before freeing it. | 
 |  | 
 | Already fixed in 2.6.19. | 
 |  | 
 | Signed-off-by: Milan Broz <mbroz@redhat.com> | 
 | Signed-off-by: Chris Wright <chrisw@sous-sol.org> | 
 | --- | 
 |  drivers/md/dm-snap.c |    1 + | 
 |  1 file changed, 1 insertion(+) | 
 |  | 
 | --- linux-2.6.18.5.orig/drivers/md/dm-snap.c | 
 | +++ linux-2.6.18.5/drivers/md/dm-snap.c | 
 | @@ -691,6 +691,7 @@ static void pending_complete(struct pend | 
 |   | 
 |  		free_exception(e); | 
 |   | 
 | +		remove_exception(&pe->e); | 
 |  		error_snapshot_bios(pe); | 
 |  		goto out; | 
 |  	} |