• Lars Ellenberg's avatar
    drbd: fix potential access after free · c12e9c89
    Lars Ellenberg authored
    Occasionally, if we disconnect, we triggered this assert:
      block drbd7: ASSERT FAILED tl_hash[27] == c30b0f04, expected NULL
    
    hlist_del() happens only on master bio completion.
    
    We used to wait for pending IO to complete before freeing tl_hash
    on disconnect. We no longer do so, since we learned to "freeze"
    IO on disconnect.
    
    If the local disk is too slow, we may reach C_STANDALONE early,
    and there are still some requests pending locally when we call
    drbd_free_tl_hash().
    
    If we now free the tl_hash, and later the local IO completion completes
    the master bio, which then does hlist_del() and clobbers freed memory.
    
    Do hlist_del_init() and hlist_add_fake() before kfree(tl_hash),
    so the hlist_del() on master bio completion is harmless.
    Signed-off-by: default avatarPhilipp Reisner <philipp.reisner@linbit.com>
    Signed-off-by: default avatarLars Ellenberg <lars.ellenberg@linbit.com>
    c12e9c89
drbd_receiver.c 130 KB