iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drbd: fix drbd_destroy_device reference count updates

Browse Source 
drbd_destroy_device means to give up reference counts
on the connection(s) reachable via the peer_device(s).

It must not do that by iterating via device->resource->connections,
resource and connections may have already been disassociated
by drbd_free_resource, and we'd leak connection refs.

Instead, iterate via device->peer_devices->connection.

Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
This commit is contained in:
Lars Ellenberg 2014-05-14 21:34:47 +02:00 committed by Philipp Reisner
parent c2258ffc56
commit a8ba0d6069
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/block/drbd/drbd_main.c
View File

@ -2160,7 +2160,7 @@ void drbd_destroy_device(struct kref *kref)
{ {
struct drbd_device *device = container_of(kref, struct drbd_device, kref); struct drbd_device *device = container_of(kref, struct drbd_device, kref);
struct drbd_resource *resource = device->resource; struct drbd_resource *resource = device->resource;
struct drbd_connection *connection; struct drbd_peer_device *peer_device, *tmp_peer_device;
del_timer_sync(&device->request_timer); del_timer_sync(&device->request_timer);
@ -2191,12 +2191,16 @@ void drbd_destroy_device(struct kref *kref)
put_disk(device->vdisk); put_disk(device->vdisk);
blk_cleanup_queue(device->rq_queue); blk_cleanup_queue(device->rq_queue);
kfree(device->rs_plan_s); kfree(device->rs_plan_s);
kfree(first_peer_device(device));
/* not for_each_connection(connection, resource):
* those may have been cleaned up and disassociated already.
*/
for_each_peer_device_safe(peer_device, tmp_peer_device, device) {
kref_put(&peer_device->connection->kref, drbd_destroy_connection);
kfree(peer_device);
}
memset(device, 0xfd, sizeof(*device)); memset(device, 0xfd, sizeof(*device));
kfree(device); kfree(device);
for_each_connection(connection, resource)
kref_put(&connection->kref, drbd_destroy_connection);
kref_put(&resource->kref, drbd_destroy_resource); kref_put(&resource->kref, drbd_destroy_resource);
} }