lkml.org 
[lkml]   [2016]   [Aug]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] bdev: fix NULL pointer dereference in sync()/close() race
Hello,

On Mon, Aug 29, 2016 at 11:33:41PM +0200, Vegard Nossum wrote:
> On 08/29/2016 09:55 PM, Tejun Heo wrote:
> > I think the right thing to do there is doing blkdev_get() /
> > blkdev_put() around func() invocation in iterate_bdevs() rather than
> > holding bd_mutex across the callback. Can you please verify whether
> > that works?
>
> Didn't work for me, I kept getting use-after-free in __blkdev_get() on
> bdev->bd_invalidated after it calls bdev->bd_disk->fops->open(). I tried
> a few related things without much luck.

I see. It could be that it's doing blkdev_get() on a dying device.

> The only thing that worked for me without holding the mutex across the
> call was this:
...
> + mutex_lock(&bdev->bd_mutex);
> + bdev->bd_openers++;
> + bdev->bd_holders++;
> + mutex_unlock(&bdev->bd_mutex);
> +
> + func(bdev, arg);
> +
> + mutex_lock(&bdev->bd_mutex);
> + bdev->bd_openers--;
> + bdev->bd_holders--;
> + mutex_unlock(&bdev->bd_mutex);

And this might not be too far fetched. I think what we want is

* Bump bd_openers if there are other users already; otherwise, skip.

* blkdev_put() after the callback is finished.

Thanks.

--
tejun

\
 
 \ /
  Last update: 2016-09-17 09:58    [W:0.098 / U:0.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site