summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorSlava Pestov <sp@daterainc.com>2014-06-19 22:05:59 (GMT)
committerKent Overstreet <kmo@daterainc.com>2014-08-04 22:23:04 (GMT)
commitc9a78332b42cbdcdd386a95192a716b67d1711a4 (patch)
tree425e035b57317fa9730d717352cee12ab2c8bccd /drivers
parentbf0c55c986540483c34ca640f2eef4c3314388b1 (diff)
downloadlinux-c9a78332b42cbdcdd386a95192a716b67d1711a4.tar.xz
bcache: fix memory corruption in init error path
If register_cache_set() failed, we would touch ca->set after it had already been freed. Also, fix an assertion to catch this. Change-Id: I748e5f5b223e2d9b2602075dec2f997cced2394d
Diffstat (limited to 'drivers')
-rw-r--r--drivers/md/bcache/super.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 72fbaf7..12ad381 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1356,8 +1356,11 @@ static void cache_set_free(struct closure *cl)
bch_journal_free(c);
for_each_cache(ca, c, i)
- if (ca)
+ if (ca) {
+ ca->set = NULL;
+ c->cache[ca->sb.nr_this_dev] = NULL;
kobject_put(&ca->kobj);
+ }
bch_bset_sort_state_free(&c->sort);
free_pages((unsigned long) c->uuids, ilog2(bucket_pages(c)));
@@ -1794,8 +1797,10 @@ void bch_cache_release(struct kobject *kobj)
struct cache *ca = container_of(kobj, struct cache, kobj);
unsigned i;
- if (ca->set)
+ if (ca->set) {
+ BUG_ON(ca->set->cache[ca->sb.nr_this_dev] != ca);
ca->set->cache[ca->sb.nr_this_dev] = NULL;
+ }
bio_split_pool_free(&ca->bio_split_hook);
@@ -1858,7 +1863,7 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca)
}
static void register_cache(struct cache_sb *sb, struct page *sb_page,
- struct block_device *bdev, struct cache *ca)
+ struct block_device *bdev, struct cache *ca)
{
char name[BDEVNAME_SIZE];
const char *err = "cannot allocate memory";