Re: [PATCH 2/2] dm: Avoid use-after-free of a mapped device

2013-02-25 Thread Jun'ichi Nomura
Hello Bart, On 02/22/13 19:47, Bart Van Assche wrote: As the comment above rq_completed() explains, md members must not be touched after the dm_put() at the end of that function has been invoked. Avoid that the md-queue can be run asynchronously after the last md reference has been dropped by

Re: [PATCH 2/2] dm: Avoid use-after-free of a mapped device

2013-02-25 Thread Bart Van Assche
On 02/25/13 10:49, Jun'ichi Nomura wrote: diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 314a0e2..51fefb5 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -1973,15 +1973,27 @@ static void __bind_mempools(struct mapped_device *md, struct dm_table *t) { struct dm_md_mempools

Re: [PATCH 2/2] dm: Avoid use-after-free of a mapped device

2013-02-25 Thread Jun'ichi Nomura
On 02/26/13 00:09, Bart Van Assche wrote: Without your patch my test failed after two or three iterations. With your patch my test is still running after 53 iterations. So if you want you can add Tested-by: Bart Van Assche bvanass...@acm.org. Great. Thanks for testing. I'll submit a patch

[PATCH 2/2] dm: Avoid use-after-free of a mapped device

2013-02-22 Thread Bart Van Assche
As the comment above rq_completed() explains, md members must not be touched after the dm_put() at the end of that function has been invoked. Avoid that the md-queue can be run asynchronously after the last md reference has been dropped by running that queue synchronously. This patch fixes the

Re: [PATCH 2/2] dm: Avoid use-after-free of a mapped device

2013-02-22 Thread Mike Snitzer
On Fri, Feb 22 2013 at 5:47am -0500, Bart Van Assche bvanass...@acm.org wrote: As the comment above rq_completed() explains, md members must not be touched after the dm_put() at the end of that function has been invoked. Avoid that the md-queue can be run asynchronously after the last md

Re: [PATCH 2/2] dm: Avoid use-after-free of a mapped device

2013-02-22 Thread Bart Van Assche
On 02/22/13 12:08, Mike Snitzer wrote: On Fri, Feb 22 2013 at 5:47am -0500, Bart Van Assche bvanass...@acm.org wrote: As the comment above rq_completed() explains, md members must not be touched after the dm_put() at the end of that function has been invoked. Avoid that the md-queue can be

Re: [PATCH 2/2] dm: Avoid use-after-free of a mapped device

2013-02-22 Thread Mike Snitzer
On Fri, Feb 22 2013 at 6:22am -0500, Bart Van Assche bvanass...@acm.org wrote: On 02/22/13 12:08, Mike Snitzer wrote: On Fri, Feb 22 2013 at 5:47am -0500, Bart Van Assche bvanass...@acm.org wrote: As the comment above rq_completed() explains, md members must not be touched after the