On (Fri) 30 Sep 2011 [11:39:11], Stefan Hajnoczi wrote: > QED's metadata caching strategy allows two parallel requests to race for > metadata lookup. The first one to complete will populate the metadata > cache and the second one will drop the data it just read in favor of the > cached data. > > There is a use-after-free in qed_read_l2_table_cb() and > qed_commit_l2_update() where l2_table->offset was used after the > l2_table may have been freed due to a metadata lookup race. Fix this by > keeping the l2_offset in a local variable and not reaching into the > possibly freed l2_table. > > Reported-by: Amit Shah <amit.s...@redhat.com> > Signed-off-by: Stefan Hajnoczi <stefa...@linux.vnet.ibm.com> > --- > Hi Amit, > Thanks for reporting the assertion failure you saw at http://fpaste.org/CDuv/. > Does this patch fix the problem?
Yes, this fixes it. Thanks, Amit