Commit 6a51830e authored Apr 30, 2008 by Dan Williams Committed by Linus Torvalds Apr 30, 2008

md: fix use after free when removing rdev via sysfs



rdev->mddev is no longer valid upon return from entry->store() when the
'remove' command is given.

Cc: <stable@kernel.org>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 7f1133cb

drivers/md/md.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2097,7 +2097,7 @@ rdev_attr_store(struct kobject kobj, struct attribute attr,
		rv = -EBUSY;
		else
		rv = entry->store(rdev, page, length);
		mddev_unlock(rdev->mddev);
		mddev_unlock(mddev);
		}
		return rv;
		}