[Xen-devel] Re: Crash on blktap shutdown

[Daniel Stodden <daniel.stodden@xxxxxxxxxx>]

On Wed, 2010-02-24 at 19:12 -0500, Daniel Stodden wrote:
> On Wed, 2010-02-24 at 18:26 -0500, Jeremy Fitzhardinge wrote:
> > On 02/24/2010 03:20 PM, Daniel Stodden wrote:
> > > Jake, any immediate ideas?
> > >    
> > 
> > Just got another one on domain shutdown.  The crashing instruction is:
> > 0xffffffff8104a3f2 <lock_timer_base+17>:    mov    0x28(%r12),%r14
> > 
> 
> Oh, a classic.
> 
> I think I had the same issue somewhere in blktap1 when moving to 2.6.27.
> 
> Coming.

This should do. 100% untested.

--snip---
blktap/device: Fix wild ptr deref during device destruction.

A put_disk() before blk_cleanup_queue() would free gd before gd->queue
is read.

Signed-off-by: Daniel Stodden <daniel.stodden@xxxxxxxxxx>

diff -r 7d0b5bd0725f drivers/xen/blktap/device.c
--- a/drivers/xen/blktap/device.c       Fri Feb 05 11:12:24 2010 -0800
+++ b/drivers/xen/blktap/device.c       Wed Feb 24 16:13:26 2010 -0800
@@ -1027,8 +1027,8 @@
 #endif
 
        del_gendisk(dev->gd);
+       blk_cleanup_queue(dev->gd->queue);
        put_disk(dev->gd);
-       blk_cleanup_queue(dev->gd->queue);
 
        dev->gd = NULL;
 



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel