lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

blkfront: don't access freed struct xenbus_device

Browse Source 
Unfortunately commit "blkfront: fixes for 'xm block-detach ... --force'"
still wasn't quite right - there was a reference to freed memory left
from blkfront_closing().

Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
This commit is contained in:
Jan Beulich
2010-08-07 18:31:12 +02:00
committed by Jens Axboe
parent 0e34582699
commit 5d7ed20e82
1 changed files with 16 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
drivers/block/xen-blkfront.c
View File

@@ -981,13 +981,11 @@ static void blkfront_connect(struct blkfront_info *info)
* the backend. Once is this done, we can switch to Closed in * the backend. Once is this done, we can switch to Closed in
* acknowledgement. * acknowledgement.
*/ */
static void blkfront_closing(struct xenbus_device *dev) static void blkfront_closing(struct blkfront_info *info)
{ {
struct blkfront_info *info = dev_get_drvdata(&dev->dev);
unsigned int minor, nr_minors; unsigned int minor, nr_minors;
unsigned long flags; unsigned long flags;
dev_dbg(&dev->dev, "blkfront_closing: %s removed\n", dev->nodename);
if (info->rq == NULL) if (info->rq == NULL)
goto out; goto out;
@@ -1013,7 +1011,8 @@ static void blkfront_closing(struct xenbus_device *dev)
xlbd_release_minors(minor, nr_minors); xlbd_release_minors(minor, nr_minors);
out: out:
xenbus_frontend_closed(dev); if (info->xbdev)
xenbus_frontend_closed(info->xbdev);
} }
/** /**
@@ -1053,7 +1052,7 @@ static void blkback_changed(struct xenbus_device *dev,
xenbus_dev_error(dev, -EBUSY, xenbus_dev_error(dev, -EBUSY,
"Device in use; refusing to close"); "Device in use; refusing to close");
else else
blkfront_closing(dev); blkfront_closing(info);
mutex_unlock(&bd->bd_mutex); mutex_unlock(&bd->bd_mutex);
bdput(bd); bdput(bd);
break; break;
@@ -1071,7 +1070,7 @@ static int blkfront_remove(struct xenbus_device *dev)
if(info->users == 0) if(info->users == 0)
kfree(info); kfree(info);
else else
info->is_ready = -1; info->xbdev = NULL;
return 0; return 0;
} }
@@ -1080,22 +1079,21 @@ static int blkfront_is_ready(struct xenbus_device *dev)
{ {
struct blkfront_info *info = dev_get_drvdata(&dev->dev); struct blkfront_info *info = dev_get_drvdata(&dev->dev);
return info->is_ready > 0; return info->is_ready && info->xbdev;
} }
static int blkif_open(struct block_device *bdev, fmode_t mode) static int blkif_open(struct block_device *bdev, fmode_t mode)
{ {
struct blkfront_info *info = bdev->bd_disk->private_data; struct blkfront_info *info = bdev->bd_disk->private_data;
int ret = 0;
if (!info->xbdev)
return -ENODEV;
lock_kernel(); lock_kernel();
if (info->is_ready < 0)
ret = -ENODEV;
else
info->users++; info->users++;
unlock_kernel(); unlock_kernel();
return ret; return 0;
} }
static int blkif_release(struct gendisk *disk, fmode_t mode) static int blkif_release(struct gendisk *disk, fmode_t mode)
@@ -1108,13 +1106,13 @@ static int blkif_release(struct gendisk *disk, fmode_t mode)
have ignored this request initially, as the device was have ignored this request initially, as the device was
still mounted. */ still mounted. */
struct xenbus_device *dev = info->xbdev; struct xenbus_device *dev = info->xbdev;
enum xenbus_state state = xenbus_read_driver_state(dev->otherend);
if(info->is_ready < 0) { if (!dev) {
blkfront_closing(dev); blkfront_closing(info);
kfree(info); kfree(info);
} else if (state == XenbusStateClosing && info->is_ready) } else if (xenbus_read_driver_state(dev->otherend)
blkfront_closing(dev); == XenbusStateClosing && info->is_ready)
blkfront_closing(info);
} }
unlock_kernel(); unlock_kernel();
return 0; return 0;