| From stable-bounces@linux.kernel.org Wed Apr 30 11:55:59 2008 |
| From: Dan Williams <dan.j.williams@intel.com> |
| Date: Wed, 30 Apr 2008 18:55:30 GMT |
| Subject: md: fix use after free when removing rdev via sysfs |
| To: jejb@kernel.org, stable@kernel.org |
| Message-ID: <200804301855.m3UItUSb012853@hera.kernel.org> |
| |
| From: Dan Williams <dan.j.williams@intel.com> |
| |
| commit: 6a51830e14529063cb2685921e1177d9af50e49a upstream |
| |
| rdev->mddev is no longer valid upon return from entry->store() when the |
| 'remove' command is given. |
| |
| Signed-off-by: Dan Williams <dan.j.williams@intel.com> |
| Signed-off-by: Neil Brown <neilb@suse.de> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/md/md.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/md/md.c |
| +++ b/drivers/md/md.c |
| @@ -2096,7 +2096,7 @@ rdev_attr_store(struct kobject *kobj, st |
| rv = -EBUSY; |
| else |
| rv = entry->store(rdev, page, length); |
| - mddev_unlock(rdev->mddev); |
| + mddev_unlock(mddev); |
| } |
| return rv; |
| } |
