Skip to content

Commit 20a8e45

Browse files
zoumingzheaxboe
authored andcommitted
bcache: fix uninitialized closure object
In the previous patch ("bcache: fix cached_dev.sb_bio use-after-free and crash"), we adopted a simple modification suggestion from AI to fix the use-after-free. But in actual testing, we found an extreme case where the device is stopped before calling bch_write_bdev_super(). At this point, struct closure sb_write has not been initialized yet. For this patch, we ensure that sb_bio has been completed via sb_write_mutex. Signed-off-by: Mingzhe Zou <mingzhe.zou@easystack.cn> Signed-off-by: Coly Li <colyli@fnnas.com> Link: https://patch.msgid.link/20260403042135.2221247-1-colyli@fnnas.com Fixes: fec114a ("bcache: fix cached_dev.sb_bio use-after-free and crash") Signed-off-by: Jens Axboe <axboe@kernel.dk>
1 parent fec114a commit 20a8e45

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

drivers/md/bcache/super.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1378,7 +1378,8 @@ static CLOSURE_CALLBACK(cached_dev_free)
13781378
* The sb_bio is embedded in struct cached_dev, so we must
13791379
* ensure no I/O is in progress.
13801380
*/
1381-
closure_sync(&dc->sb_write);
1381+
down(&dc->sb_write_mutex);
1382+
up(&dc->sb_write_mutex);
13821383

13831384
if (dc->sb_disk)
13841385
folio_put(virt_to_folio(dc->sb_disk));

0 commit comments

Comments
 (0)