| commit | 0fd22b45b2d2e1de162d6a47327d449e0ed45ad2 | [log] [tgz] |
|---|---|---|
| author | Shaohua Li <shli@fb.com> | Wed Sep 02 13:49:47 2015 -0700 |
| committer | NeilBrown <neilb@suse.com> | Sun Nov 01 13:48:26 2015 +1100 |
| tree | 19405695d4fee2c0d07ede5af8d95e54952c459b | |
| parent | a8c34f915976e3de044cc31b8bcb46f816f5a52e [diff] |
raid5-cache: fix a user-after-free bug r5l_compress_stripe_end_list() can free an io_unit. This breaks the assumption only reclaimer can free io_unit. We can add a reference count based io_unit free, but since only reclaim can wait io_unit becoming to STRIPE_END state, we use a simple global wait queue here. Signed-off-by: Shaohua Li <shli@fb.com> Signed-off-by: NeilBrown <neilb@suse.com>