From: Mikulas Patocka Date: Fri, 10 Jul 2015 21:21:43 +0000 (-0400) Subject: dm: fix use after free crash due to incorrect cleanup sequence X-Git-Tag: v5.15~15409^2~6 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=b06075a98d595b761881fb2d7b8a557ea2f8b7ac;p=platform%2Fkernel%2Flinux-starfive.git dm: fix use after free crash due to incorrect cleanup sequence Linux 4.2-rc1 Commit 0f20972f7bf6 ("dm: factor out a common cleanup_mapped_device()") moved a common cleanup code to a separate function. Unfortunately, that commit incorrectly changed the order of cleanup, so that it destroys the mapped_device's srcu structure 'io_barrier' before destroying its workqueue. The function that is executed on the workqueue (dm_wq_work) uses the srcu structure, thus it may use it after being freed. That results in a crash in the LVM test suite's mirror-vgreduce-removemissing.sh test. Signed-off-by: Mikulas Patocka Fixes: 0f20972f7bf6 ("dm: factor out a common cleanup_mapped_device()") Signed-off-by: Mike Snitzer --- diff --git a/drivers/md/dm.c b/drivers/md/dm.c index de70377..ab37ae1 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2277,8 +2277,6 @@ static void dm_init_old_md_queue(struct mapped_device *md) static void cleanup_mapped_device(struct mapped_device *md) { - cleanup_srcu_struct(&md->io_barrier); - if (md->wq) destroy_workqueue(md->wq); if (md->kworker_task) @@ -2290,6 +2288,8 @@ static void cleanup_mapped_device(struct mapped_device *md) if (md->bs) bioset_free(md->bs); + cleanup_srcu_struct(&md->io_barrier); + if (md->disk) { spin_lock(&_minor_lock); md->disk->private_data = NULL;