Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c2258ffc authored by Lars Ellenberg's avatar Lars Ellenberg Committed by Philipp Reisner
Browse files

drbd: poison free'd device, resource and connection structs 



Now that we have additional asynchronous kref_get/kref_put
via debugfs, make sure we catch access after free.

Poison struct drbd_device, drbd_connection and drbd_resource
before kfree() with 0xfd, 0xfc, and 0xf2, respectively.

Signed-off-by: default avatarPhilipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: default avatarLars Ellenberg <lars.ellenberg@linbit.com>
parent 45d2933c

drivers/block/drbd/drbd_main.c

+3 −0
Original line number Diff line number Diff line
@@ -2192,6 +2192,7 @@ void drbd_destroy_device(struct kref *kref) 
	blk_cleanup_queue(device->rq_queue);

	kfree(device->rs_plan_s);

	kfree(first_peer_device(device));

	memset(device, 0xfd, sizeof(*device));

	kfree(device);



	for_each_connection(connection, resource)
@@ -2285,6 +2286,7 @@ void drbd_destroy_resource(struct kref *kref) 
	idr_destroy(&resource->devices);

	free_cpumask_var(resource->cpu_mask);

	kfree(resource->name);

	memset(resource, 0xf2, sizeof(*resource));

	kfree(resource);

}
@@ -2665,6 +2667,7 @@ void drbd_destroy_connection(struct kref *kref) 
	drbd_free_socket(&connection->data);

	kfree(connection->int_dig_in);

	kfree(connection->int_dig_vv);

	memset(connection, 0xfc, sizeof(*connection));

	kfree(connection);

	kref_put(&resource->kref, drbd_destroy_resource);

}