• Eric Sandeen's avatar
    xfs: fix buffer use after free on IO error · 8d6c1210
    Eric Sandeen authored
    When testing exhaustion of dm snapshots, the following appeared
    ODEBUG: free active (active state 0) object type: work_struct hint: xfs_buf_iodone_work+0x0/0x1d0 [xfs]
    indicating that we'd freed a buffer which still had a pending reference,
    down this path:
    [  190.867975]  [<ffffffff8133e6fb>] debug_check_no_obj_freed+0x22b/0x270
    [  190.880820]  [<ffffffff811da1d0>] kmem_cache_free+0xd0/0x370
    [  190.892615]  [<ffffffffa02c5924>] xfs_buf_free+0xe4/0x210 [xfs]
    [  190.905629]  [<ffffffffa02c6167>] xfs_buf_rele+0xe7/0x270 [xfs]
    [  190.911770]  [<ffffffffa034c826>] xfs_trans_read_buf_map+0x7b6/0xac0 [xfs]
    At issue is the fact that if IO fails in xfs_buf_iorequest,
    we'll queue completion unconditionally, and then call
    xfs_buf_rele; but if IO failed, there are no IOs remaining,
    and xfs_buf_rele will free the bp while work is still queued.
    Fix this by not scheduling completion if the buffer has
    an error on it; run it immediately.  The rest is only comment
    Thanks to dchinner for spotting the root cause.
    Signed-off-by: default avatarEric Sandeen <sandeen@redhat.com>
    Reviewed-by: default avatarBrian Foster <bfoster@redhat.com>
    Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
xfs_buf.c 42.7 KB