Skip to content
Commit 079fa166 authored by NeilBrown's avatar NeilBrown
Browse files

md/raid1,10: Remove use-after-free bug in make_request.

A single request to RAID1 or RAID10 might result in multiple
requests if there are known bad blocks that need to be avoided.

To detect if we need to submit another write request we test:
 	if (sectors_handled < (bio->bi_size >> 9)) {

However this is after we call **_write_done() so the 'bio' no longer
belongs to us - the writes could have completed and the bio freed.

So move the **_write_done call until after the test against
bio->bi_size.

This addresses https://bugzilla.kernel.org/show_bug.cgi?id=41862



Reported-by: default avatarBruno Wolff III <bruno@wolff.to>
Tested-by: default avatarBruno Wolff III <bruno@wolff.to>
Signed-off-by: default avatarNeilBrown <neilb@suse.de>
parent 19d5f834
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment