dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

md: fix use after free when removing rdev via sysfs 

rdev->mddev is no longer valid upon return from entry->store() when the
'remove' command is given.

Cc: <stable@kernel.org>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Dan Williams 2008-04-30 00:52:28 -07:00 committed by Linus Torvalds
parent 7f1133cbf2
commit 6a51830e14
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/md/md.c
View File

@ -2097,7 +2097,7 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,
rv = -EBUSY;
else
rv = entry->store(rdev, page, length);
mddev_unlock(rdev->mddev);
mddev_unlock(mddev);
}
return rv;
}