lkml.org 
[lkml]   [2017]   [Jun]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 121/212] md: ensure md devices are freed before module is unloaded.
    3.16.44-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: NeilBrown <neilb@suse.com>

    commit 9356863c9409efc79029c01a85d015efae977e69 upstream.

    Commit: cbd199837750 ("md: Fix unfortunate interaction with evms")
    change mddev_put() so that it would not destroy an md device while
    ->ctime was non-zero.

    Unfortunately, we didn't make sure to clear ->ctime when unloading
    the module, so it is possible for an md device to remain after
    module unload. An attempt to open such a device will trigger
    an invalid memory reference in:
    get_gendisk -> kobj_lookup -> exact_lock -> get_disk

    when tring to access disk->fops, which was in the module that has
    been removed.

    So ensure we clear ->ctime in md_exit(), and explain how that is useful,
    as it isn't immediately obvious when looking at the code.

    Fixes: cbd199837750 ("md: Fix unfortunate interaction with evms")
    Tested-by: Guoqing Jiang <gqjiang@suse.com>
    Signed-off-by: NeilBrown <neilb@suse.com>
    Signed-off-by: Shaohua Li <shli@fb.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/md/md.c | 7 +++++++
    1 file changed, 7 insertions(+)

    --- a/drivers/md/md.c
    +++ b/drivers/md/md.c
    @@ -8714,7 +8714,14 @@ static __exit void md_exit(void)

    for_each_mddev(mddev, tmp) {
    export_array(mddev);
    + mddev->ctime = 0;
    mddev->hold_active = 0;
    + /*
    + * for_each_mddev() will call mddev_put() at the end of each
    + * iteration. As the mddev is now fully clear, this will
    + * schedule the mddev for destruction by a workqueue, and the
    + * destroy_workqueue() below will wait for that to complete.
    + */
    }
    destroy_workqueue(md_misc_wq);
    destroy_workqueue(md_wq);
    \
     
     \ /
      Last update: 2017-06-01 18:13    [W:4.096 / U:0.276 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site