On (Fri) 30 Sep 2011 [11:39:11], Stefan Hajnoczi wrote:
> QED's metadata caching strategy allows two parallel requests to race for
> metadata lookup. The first one to complete will populate the metadata
> cache and the second one will drop the data it just read in favor of the
> cached data.
>
> There is a use-after-free in qed_read_l2_table_cb() and
> qed_commit_l2_update() where l2_table->offset was used after the
> l2_table may have been freed due to a metadata lookup race. Fix this by
> keeping the l2_offset in a local variable and not reaching into the
> possibly freed l2_table.
>
> Reported-by: Amit Shah <[email protected]>
> Signed-off-by: Stefan Hajnoczi <[email protected]>
> ---
> Hi Amit,
> Thanks for reporting the assertion failure you saw at http://fpaste.org/CDuv/.
> Does this patch fix the problem?
Yes, this fixes it.
Thanks,
Amit
