|
 |
02eaf0 |
From: "Gayatri Vasudevan" <gayatri.vasudevan@oracle.com>
|
|
|
02eaf0 |
Date: Fri, 21 Dec 2018 11:45:15 -0800
|
|
|
02eaf0 |
Subject: oracleasm: Fix use after free for request processing timer
|
|
|
02eaf0 |
|
|
|
02eaf0 |
Update r->r_elapsed under the spinlock to avoid racing with the
|
|
|
02eaf0 |
completion code freeing the asm_request.
|
|
|
02eaf0 |
|
|
|
02eaf0 |
This change bas been backported from UEK4 from the following commit
|
|
|
02eaf0 |
9897de3bb02964dff8d331a5c8a0d538392e4a3b
|
|
|
02eaf0 |
"(oracleasm: Fix use after free for request processing timer)"
|
|
|
02eaf0 |
|
|
|
02eaf0 |
Orabug: 28660867
|
|
|
02eaf0 |
|
|
|
02eaf0 |
Signed-off-by: Gayatri Vasudevan <gayatri.vasudevan@oracle.com>
|
|
|
02eaf0 |
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
|
|
|
02eaf0 |
---
|
|
|
02eaf0 |
source/drivers/block/oracleasm/driver.c | 3 +--
|
|
|
02eaf0 |
1 file changed, 1 insertion(+), 2 deletions(-)
|
|
|
02eaf0 |
|
|
|
02eaf0 |
diff --git a/drivers/block/oracleasm/driver.c b/drivers/block/oracleasm/driver.c
|
|
|
02eaf0 |
index 0488159..40a441b 100644
|
|
|
02eaf0 |
--- a/drivers/block/oracleasm/driver.c
|
|
|
02eaf0 |
+++ b/drivers/block/oracleasm/driver.c
|
|
|
02eaf0 |
@@ -1104,6 +1104,7 @@ static void asm_finish_io(struct asm_request *r)
|
|
|
02eaf0 |
if (r->r_error)
|
|
|
02eaf0 |
r->r_status |= ASM_ERROR;
|
|
|
02eaf0 |
r->r_status |= ASM_COMPLETED;
|
|
|
02eaf0 |
+ r->r_elapsed = ((jiffies - r->r_elapsed) * 1000000) / HZ;
|
|
|
02eaf0 |
|
|
|
02eaf0 |
spin_unlock_irqrestore(&afi->f_lock, flags);
|
|
|
02eaf0 |
|
|
|
02eaf0 |
@@ -1117,8 +1118,6 @@ static void asm_finish_io(struct asm_request *r)
|
|
|
02eaf0 |
}
|
|
|
02eaf0 |
}
|
|
|
02eaf0 |
|
|
|
02eaf0 |
- r->r_elapsed = ((jiffies - r->r_elapsed) * 1000000) / HZ;
|
|
|
02eaf0 |
-
|
|
|
02eaf0 |
mlog(ML_REQUEST, "Finished request 0x%p\n", r);
|
|
|
02eaf0 |
|
|
|
02eaf0 |
wake_up(&afi->f_wait);
|
|
|
02eaf0 |
--
|
|
|
02eaf0 |
1.8.3.1
|