• Mikulas Patocka's avatar
    dm: fix use after free crash due to incorrect cleanup sequence · b06075a9
    Mikulas Patocka authored
    Linux 4.2-rc1 Commit 0f20972f ("dm: factor out a common
    cleanup_mapped_device()") moved a common cleanup code to a separate
    function.  Unfortunately, that commit incorrectly changed the order of
    cleanup, so that it destroys the mapped_device's srcu structure
    'io_barrier' before destroying its workqueue.
    
    The function that is executed on the workqueue (dm_wq_work) uses the srcu
    structure, thus it may use it after being freed.  That results in a
    crash in the LVM test suite's mirror-vgreduce-removemissing.sh test.
    Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
    Fixes: 0f20972f ("dm: factor out a common cleanup_mapped_device()")
    Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
    b06075a9
dm.c 85 KB