diff options
| author | Dan Williams <dan.j.williams@intel.com> | 2008-04-30 18:55:30 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2008-05-09 21:40:43 -0700 |
| commit | 9bd2c7ca75b0ebe05b0c67852d050720119983e7 (patch) | |
| tree | d4b3f8735356b9825648fdc9b1253460be3bd59a | |
| parent | 30e525eb19e64ded33f84529314f0dc82766553a (diff) | |
md: fix use after free when removing rdev via sysfs
commit: 6a51830e14529063cb2685921e1177d9af50e49a upstream
rdev->mddev is no longer valid upon return from entry->store() when the
'remove' command is given.
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/md/md.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/md/md.c b/drivers/md/md.c index 61ccbd2683fa..9f6d228b5607 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -2096,7 +2096,7 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr, rv = -EBUSY; else rv = entry->store(rdev, page, length); - mddev_unlock(rdev->mddev); + mddev_unlock(mddev); } return rv; } |