* [PATCH] Linux: blktap2: Fwd: Fix wild ptr deref during device destruction.
@ 2010-03-01 9:17 Jan Beulich
0 siblings, 0 replies; only message in thread
From: Jan Beulich @ 2010-03-01 9:17 UTC (permalink / raw)
To: xen-devel; +Cc: Daniel Stodden
[-- Attachment #1: Type: text/plain, Size: 456 bytes --]
A put_disk() before blk_cleanup_queue() would free gd before gd->queue
is read.
Signed-off-by: Daniel Stodden <daniel.stodden@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@novell.com>
--- a/drivers/xen/blktap2/device.c
+++ b/drivers/xen/blktap2/device.c
@@ -1077,8 +1077,8 @@
#endif
del_gendisk(dev->gd);
+ blk_cleanup_queue(dev->gd->queue);
put_disk(dev->gd);
- blk_cleanup_queue(dev->gd->queue);
dev->gd = NULL;
[-- Attachment #2: blktap2-wild-ptr-deref.patch --]
[-- Type: text/plain, Size: 517 bytes --]
Subject: blktap2: Fix wild ptr deref during device destruction.
A put_disk() before blk_cleanup_queue() would free gd before gd->queue
is read.
Signed-off-by: Daniel Stodden <daniel.stodden@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@novell.com>
--- a/drivers/xen/blktap2/device.c
+++ b/drivers/xen/blktap2/device.c
@@ -1077,8 +1077,8 @@
#endif
del_gendisk(dev->gd);
+ blk_cleanup_queue(dev->gd->queue);
put_disk(dev->gd);
- blk_cleanup_queue(dev->gd->queue);
dev->gd = NULL;
[-- Attachment #3: Type: text/plain, Size: 138 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2010-03-01 9:17 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-03-01 9:17 [PATCH] Linux: blktap2: Fwd: Fix wild ptr deref during device destruction Jan Beulich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).