Re: + md-raid10-fix-use-after-free-of-bio.patch added to -mm tree

Re: + md-raid10-fix-use-after-free-of-bio.patch added to -mm tree

[Neil Brown]

On Saturday July 28, akpm@linux-foundation.org wrote:
> 
> The patch titled
>      md: raid10: fix use-after-free of bio
> has been added to the -mm tree.  Its filename is
>      md-raid10-fix-use-after-free-of-bio.patch
> 
> *** Remember to use Documentation/SubmitChecklist when testing your code ***
> 
> See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
> out what to do about this
> 
> ------------------------------------------------------
> Subject: md: raid10: fix use-after-free of bio
> From: Maik Hampel <m.hampel@gmx.de>
> 
> In case of read errors raid10d tries to print a nice error message,
> unfortunately using data from an already put bio.
> 

Thanks for catching that Maik!

> 
> diff -puN drivers/md/raid10.c~md-raid10-fix-use-after-free-of-bio drivers/md/raid10.c
> --- a/drivers/md/raid10.c~md-raid10-fix-use-after-free-of-bio
> +++ a/drivers/md/raid10.c
> @@ -1534,7 +1534,6 @@ static void raid10d(mddev_t *mddev)
>  			bio = r10_bio->devs[r10_bio->read_slot].bio;
>  			r10_bio->devs[r10_bio->read_slot].bio =
>  				mddev->ro ? IO_BLOCKED : NULL;
> -			bio_put(bio);
>  			mirror = read_balance(conf, r10_bio);
>  			if (mirror == -1) {
>  				printk(KERN_ALERT "raid10: %s: unrecoverable I/O"
> @@ -1542,8 +1541,10 @@ static void raid10d(mddev_t *mddev)
>  				       bdevname(bio->bi_bdev,b),
>  				       (unsigned long long)r10_bio->sector);
>  				raid_end_bio_io(r10_bio);
> +				bio_put(bio);

and for catching that Andrew!

Acked-By: NeilBrown <neilb@suse.de>


>  			} else {
>  				const int do_sync = bio_sync(r10_bio->master_bio);
> +				bio_put(bio);
>  				rdev = conf->mirrors[mirror].rdev;
>  				if (printk_ratelimit())
>  					printk(KERN_ERR "raid10: %s: redirecting sector %llu to"
> _
> 
> Patches currently in -mm which might be from m.hampel@gmx.de are
> 
> md-raid10-fix-use-after-free-of-bio.patch