diff options
| author | David Chinner <dgc@sgi.com> | 2007-05-14 10:24:16 +0200 |
|---|---|---|
| committer | Tim Shimmin <tes@chook.melbourne.sgi.com> | 2007-07-14 07:22:34 +0200 |
| commit | 3db296f341b5902c4f9317022ae5d4da2d59d598 (patch) | |
| tree | f351eb33c6bac70d82d9f3adf0836d4c424bad92 /fs/xfs | |
| parent | [XFS] Sleeping with the ilock waiting for I/O completion is Bad. (diff) | |
| download | linux-3db296f341b5902c4f9317022ae5d4da2d59d598.tar.xz linux-3db296f341b5902c4f9317022ae5d4da2d59d598.zip | |
[XFS] Fix use-after-free during log unmount.
Don't reference the log buffer after running the callbacks as the callback
can trigger the log buffers to be freed during unmount.
SGI-PV: 964545
SGI-Modid: xfs-linux-melb:xfs-kern:28567a
Signed-off-by: David Chinner <dgc@sgi.com>
Signed-off-by: Christoph Hellwig <hch@infradead.org>
Signed-off-by: Tim Shimmin <tes@sgi.com>
Diffstat (limited to 'fs/xfs')
| -rw-r--r-- | fs/xfs/xfs_log.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c index 635f99e6302f..5bb902056e61 100644 --- a/fs/xfs/xfs_log.c +++ b/fs/xfs/xfs_log.c @@ -967,14 +967,16 @@ xlog_iodone(xfs_buf_t *bp) } else if (iclog->ic_state & XLOG_STATE_IOERROR) { aborted = XFS_LI_ABORTED; } + + /* log I/O is always issued ASYNC */ + ASSERT(XFS_BUF_ISASYNC(bp)); xlog_state_done_syncing(iclog, aborted); - if (!(XFS_BUF_ISASYNC(bp))) { - /* - * Corresponding psema() will be done in bwrite(). If we don't - * vsema() here, panic. - */ - XFS_BUF_V_IODONESEMA(bp); - } + /* + * do not reference the buffer (bp) here as we could race + * with it being freed after writing the unmount record to the + * log. + */ + } /* xlog_iodone */ /* |