On Fri, Sep 30, 2011 at 12:27 PM, Amit Shah <amit.s...@redhat.com> wrote: > On (Fri) 30 Sep 2011 [11:39:11], Stefan Hajnoczi wrote: >> QED's metadata caching strategy allows two parallel requests to race for >> metadata lookup. The first one to complete will populate the metadata >> cache and the second one will drop the data it just read in favor of the >> cached data. >> >> There is a use-after-free in qed_read_l2_table_cb() and >> qed_commit_l2_update() where l2_table->offset was used after the >> l2_table may have been freed due to a metadata lookup race. Fix this by >> keeping the l2_offset in a local variable and not reaching into the >> possibly freed l2_table. >> >> Reported-by: Amit Shah <amit.s...@redhat.com> >> Signed-off-by: Stefan Hajnoczi <stefa...@linux.vnet.ibm.com> >> --- >> Hi Amit, >> Thanks for reporting the assertion failure you saw at >> http://fpaste.org/CDuv/. >> Does this patch fix the problem? > > Yes, this fixes it.
Were you able to reliably reproduce the assertion failure before? I wonder because this only happens when two metadata lookups race (which is rare enough on my setup that I've never seen this failure). It might be worth trying a few times. Stefan
