lkml.org 
[lkml]   [2010]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[050/114] dm: prevent access to md being deleted
    2.6.35-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>

    commit abdc568b0540bec6d3e0afebac496adef1189b77 upstream.

    This patch prevents access to mapped_device which is being deleted.

    Currently, even after a mapped_device has been removed from the hash,
    it could be accessed through idr_find() using minor number.
    That could cause a race and NULL pointer reference below:
    CPU0 CPU1
    ------------------------------------------------------------------
    dev_remove(param)
    down_write(_hash_lock)
    dm_lock_for_deletion(md)
    spin_lock(_minor_lock)
    set_bit(DMF_DELETING)
    spin_unlock(_minor_lock)
    __hash_remove(hc)
    up_write(_hash_lock)
    dev_status(param)
    md = find_device(param)
    down_read(_hash_lock)
    __find_device_hash_cell(param)
    dm_get_md(param->dev)
    md = dm_find_md(dev)
    spin_lock(_minor_lock)
    md = idr_find(MINOR(dev))
    spin_unlock(_minor_lock)
    dm_put(md)
    free_dev(md)
    dm_get(md)
    up_read(_hash_lock)
    __dev_status(md, param)
    dm_put(md)

    This patch fixes such problems.

    Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
    Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/md/dm.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/drivers/md/dm.c
    +++ b/drivers/md/dm.c
    @@ -2141,6 +2141,7 @@ static struct mapped_device *dm_find_md(
    md = idr_find(&_minor_idr, minor);
    if (md && (md == MINOR_ALLOCED ||
    (MINOR(disk_devt(dm_disk(md))) != minor) ||
    + dm_deleting_md(md) ||
    test_bit(DMF_FREEING, &md->flags))) {
    md = NULL;
    goto out;



    \
     
     \ /
      Last update: 2010-08-25 01:07    [W:0.023 / U:31.048 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site