From owner-svn-src-head@freebsd.org Wed Nov 1 10:53:12 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1191AE575C5; Wed, 1 Nov 2017 10:53:12 +0000 (UTC) (envelope-from avg@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id D58C56855E; Wed, 1 Nov 2017 10:53:11 +0000 (UTC) (envelope-from avg@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id vA1ArA2H059660; Wed, 1 Nov 2017 10:53:10 GMT (envelope-from avg@FreeBSD.org) Received: (from avg@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id vA1ArAw8059659; Wed, 1 Nov 2017 10:53:10 GMT (envelope-from avg@FreeBSD.org) Message-Id: <201711011053.vA1ArAw8059659@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: avg set sender to avg@FreeBSD.org using -f From: Andriy Gapon Date: Wed, 1 Nov 2017 10:53:10 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r325272 - head/sys/geom X-SVN-Group: head X-SVN-Commit-Author: avg X-SVN-Commit-Paths: head/sys/geom X-SVN-Commit-Revision: 325272 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Nov 2017 10:53:12 -0000 Author: avg Date: Wed Nov 1 10:53:10 2017 New Revision: 325272 URL: https://svnweb.freebsd.org/changeset/base/325272 Log: geom_slice: fix r325227, protect against multiple calls to g_slice_free This geom does not immediately detach its consumer relying on the wither-washer to do that. Since that happens asynchronously we may get additional spoiling events. So, we need to account for that. There are multiple options for fixing this issue like detaching immediately or checking for G_CF_ORPHAN in g_slice_spoiled(). The most reliable and least intrusive fix seems to be setting geom->softc to NULL on the first call and checking for NULL on subsequent calls. This is something that the code did before r325227. Reported by: David Wolfskill , O. Hartmann Tested by: David Wolfskill (earlier version) Discussed with: mav MFC after: 1 week X-MFC with: r325227 Modified: head/sys/geom/geom_slice.c Modified: head/sys/geom/geom_slice.c ============================================================================== --- head/sys/geom/geom_slice.c Wed Nov 1 10:49:41 2017 (r325271) +++ head/sys/geom/geom_slice.c Wed Nov 1 10:53:10 2017 (r325272) @@ -71,10 +71,19 @@ g_slice_alloc(unsigned nslice, unsigned scsize) } static void -g_slice_free(struct g_slicer *gsp) +g_slice_free(struct g_geom *gp) { + struct g_slicer *gsp; - if (gsp == NULL) /* XXX: phk thinks about this */ + gsp = gp->softc; + gp->softc = NULL; + + /* + * We can get multiple spoiled events before wither-washer + * detaches our consumer, so this can get called multiple + * times. + */ + if (gsp == NULL) return; g_free(gsp->slices); if (gsp->hotspot != NULL) @@ -133,7 +142,7 @@ g_slice_access(struct g_provider *pp, int dr, int dw, */ if (error == 0 && (gp->flags & G_GEOM_WITHER) != 0 && (cp->acr + cp->acw + cp->ace) == 0) - g_slice_free(gsp); + g_slice_free(gp); return (error); } @@ -492,7 +501,7 @@ g_slice_orphan(struct g_consumer *cp) * otherwise g_slice_access() will do that after the last close. */ if ((cp->acr + cp->acw + cp->ace) == 0) - g_slice_free(gp->softc); + g_slice_free(gp); } void