dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

blkfront: don't access freed struct xenbus_device 

Unfortunately commit "blkfront: fixes for 'xm block-detach ... --force'"
still wasn't quite right - there was a reference to freed memory left
from blkfront_closing().

Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
This commit is contained in:
Jan Beulich 2010-08-07 18:31:12 +02:00 committed by Jens Axboe
parent 0e34582699
commit 5d7ed20e82
1 changed files with 16 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
drivers/block/xen-blkfront.c
View File

@ -981,13 +981,11 @@ static void blkfront_connect(struct blkfront_info *info)
* the backend. Once is this done, we can switch to Closed in
* acknowledgement.
*/
static void blkfront_closing(struct xenbus_device *dev)
static void blkfront_closing(struct blkfront_info *info)
{
struct blkfront_info *info = dev_get_drvdata(&dev->dev);
unsigned int minor, nr_minors;
unsigned long flags;
dev_dbg(&dev->dev, "blkfront_closing: %s removed\n", dev->nodename);
if (info->rq == NULL)
goto out;
@ -1013,7 +1011,8 @@ static void blkfront_closing(struct xenbus_device *dev)
xlbd_release_minors(minor, nr_minors);
out:
xenbus_frontend_closed(dev);
if (info->xbdev)
xenbus_frontend_closed(info->xbdev);
}
/**
@ -1053,7 +1052,7 @@ static void blkback_changed(struct xenbus_device *dev,
xenbus_dev_error(dev, -EBUSY,
"Device in use; refusing to close");
else
blkfront_closing(dev);
blkfront_closing(info);
mutex_unlock(&bd->bd_mutex);
bdput(bd);
break;
@ -1071,7 +1070,7 @@ static int blkfront_remove(struct xenbus_device *dev)
if(info->users == 0)
kfree(info);
else
info->is_ready = -1;
info->xbdev = NULL;
return 0;
}
@ -1080,22 +1079,21 @@ static int blkfront_is_ready(struct xenbus_device *dev)
{
struct blkfront_info *info = dev_get_drvdata(&dev->dev);
return info->is_ready > 0;
return info->is_ready && info->xbdev;
}
static int blkif_open(struct block_device *bdev, fmode_t mode)
{
struct blkfront_info *info = bdev->bd_disk->private_data;
int ret = 0;
if (!info->xbdev)
return -ENODEV;
lock_kernel();
if (info->is_ready < 0)
ret = -ENODEV;
else
info->users++;
info->users++;
unlock_kernel();
return ret;
return 0;
}
static int blkif_release(struct gendisk *disk, fmode_t mode)
@ -1108,13 +1106,13 @@ static int blkif_release(struct gendisk *disk, fmode_t mode)
have ignored this request initially, as the device was
still mounted. */
struct xenbus_device *dev = info->xbdev;
enum xenbus_state state = xenbus_read_driver_state(dev->otherend);
if(info->is_ready < 0) {
blkfront_closing(dev);
if (!dev) {
blkfront_closing(info);
kfree(info);
} else if (state == XenbusStateClosing && info->is_ready)
blkfront_closing(dev);
} else if (xenbus_read_driver_state(dev->otherend)
== XenbusStateClosing && info->is_ready)
blkfront_closing(info);
}
unlock_kernel();
return 0;