md: clear mddev->private when it has been freed. (bd691922) · Commits · 戴 / test

If ->private is set when ->run is called, it is assumed to be a 'config' prepared as part of 'reshape'. So it is important when we free that config, that we also clear ->private. This is not often a problem as the mddev will normally be discarded shortly after the config us freed. However if an 'assemble' races with a final close, the assemble can use the old mddev which has a stale ->private. This leads to any of various sorts of crashes. So clear ->private after calling ->free(). Reported-by:

Nate Clark <nate@neworld.us> Cc: stable@vger.kernel.org (v4.0+) Fixes: ("md: rename ->stop to ->free") Signed-off-by:

NeilBrown <neilb@suse.com>

drivers/md/md.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -5178,6 +5178,7 @@ int md_run(struct mddev *mddev)
		mddev_detach(mddev);
		if (mddev->private)
		pers->free(mddev, mddev->private);
		mddev->private = NULL;
		module_put(pers->owner);
		bitmap_destroy(mddev);
		return err;
		@@ -5313,6 +5314,7 @@ static void md_clean(struct mddev *mddev)
		mddev->changed = 0;
		mddev->degraded = 0;
		mddev->safemode = 0;
		mddev->private = NULL;
		mddev->merge_check_needed = 0;
		mddev->bitmap_info.offset = 0;
		mddev->bitmap_info.default_offset = 0;
		@@ -5385,6 +5387,7 @@ static void __md_stop(struct mddev *mddev)
		mddev->pers = NULL;
		spin_unlock(&mddev->lock);
		pers->free(mddev, mddev->private);
		mddev->private = NULL;
		if (pers->sync_request && mddev->to_remove == NULL)
		mddev->to_remove = &md_redundancy_group;
		module_put(pers->owner);

Admin message