md: clear mddev->private when it has been freed.
authorNeilBrown <neilb@suse.de>
Thu, 25 Jun 2015 07:01:40 +0000 (17:01 +1000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 3 Aug 2015 16:29:12 +0000 (09:29 -0700)
commitadeb846a6d8fdc8b9dc19a65393382838cad727f
tree6d727eff7120e76f2ac81684e31d7cb83717e4e1
parent499b1532e1ee4e3c6ebc1ced5a1d1e75f696262e
md: clear mddev->private when it has been freed.

commit bd6919228d7e1867ae9e24ab27e3e4a366c87d21 upstream.

If ->private is set when ->run is called, it is assumed to be
a 'config'  prepared as part of 'reshape'.

So it is important when we free that config, that we also clear ->private.
This is not often a problem as the mddev will normally be discarded
shortly after the config us freed.
However if an 'assemble' races with a final close, the assemble can use
the old mddev which has a stale ->private.  This leads to any of
various sorts of crashes.

So clear ->private after calling ->free().

Reported-by: Nate Clark <nate@neworld.us>
Fixes: afa0f557cb15 ("md: rename ->stop to ->free")
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/md/md.c