d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't set the mirror GEOM softc to NULL in g_mirror_destroy().

Browse Source 
At this point we have not rendezvous'ed with the mirror worker thread, and
I/O may still be in flight. Various I/O completion paths expect to be able
to obtain a reference to the mirror softc from the GEOM, so setting it to
NULL may result in various NULL pointer dereferences if the mirror is
stopped with -f or the kernel is shut down while a mirror is
synchronizing. The worker thread will clear the softc pointer before
exiting.

Tested by:	pho
MFC after:	2 weeks
Sponsored by:	Dell EMC Isilon
This commit is contained in:
Mark Johnston 2017-04-14 17:08:37 +00:00
parent 77011eac86
commit 1e91412e40
1 changed files with 1 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/geom/mirror/g_mirror.c
View File

@ -3076,15 +3076,8 @@ g_mirror_destroy(struct g_mirror_softc *sc, int how)
}
}
g_topology_lock();
if (sc->sc_geom->softc == NULL) {
g_topology_unlock();
if ((sc->sc_flags & G_MIRROR_DEVICE_FLAG_DESTROY) != 0)
return (0);
}
sc->sc_geom->softc = NULL;
sc->sc_sync.ds_geom->softc = NULL;
g_topology_unlock();
sc->sc_flags |= G_MIRROR_DEVICE_FLAG_DESTROY;
sc->sc_flags |= G_MIRROR_DEVICE_FLAG_WAIT;
G_MIRROR_DEBUG(4, "%s: Waking up %p.", __func__, sc);