dm sysfs: fix a module unload race

This reverts commit be35f48610 ("dm: wait until embedded kobject is
released before destroying a device") and provides an improved fix.

The kobject release code that calls the completion must be placed in a
non-module file, otherwise there is a module unload race (if the process
calling dm_kobject_release is preempted and the DM module unloaded after
the completion is triggered, but before dm_kobject_release returns).

To fix this race, this patch moves the completion code to dm-builtin.c
which is always compiled directly into the kernel if BLK_DEV_DM is
selected.

The patch introduces a new dm_kobject_holder structure, its purpose is
to keep the completion and kobject in one place, so that it can be
accessed from non-module code without the need to export the layout of
struct mapped_device to that code.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org

1 files changed, 5 insertions, 15 deletions

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index e290e72922a4..b49c76284241 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -200,11 +200,8 @@ struct mapped_device {
         /* forced geometry settings */
         struct hd_geometry geometry;
 
-        /* sysfs handle */
-        struct kobject kobj;
-
-        /* wait until the kobject is released */
-        struct completion kobj_completion;
+        /* kobject and completion */
+        struct dm_kobject_holder kobj_holder;
 
         /* zero-length flush that will be cloned and submitted to targets */
         struct bio flush_bio;
@@ -2044,7 +2041,7 @@ static struct mapped_device *alloc_dev(int minor)
         init_waitqueue_head(&md->wait);
         INIT_WORK(&md->work, dm_wq_work);
         init_waitqueue_head(&md->eventq);
-        init_completion(&md->kobj_completion);
+        init_completion(&md->kobj_holder.completion);
 
         md->disk->major = _major;
         md->disk->first_minor = minor;
@@ -2906,14 +2903,14 @@ struct gendisk *dm_disk(struct mapped_device *md)
 
 struct kobject *dm_kobject(struct mapped_device *md)
 {
-        return &md->kobj;
+        return &md->kobj_holder.kobj;
 }
 
 struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
 {
         struct mapped_device *md;
 
-        md = container_of(kobj, struct mapped_device, kobj);
+        md = container_of(kobj, struct mapped_device, kobj_holder.kobj);
 
         if (test_bit(DMF_FREEING, &md->flags) ||
             dm_deleting_md(md))
@@ -2923,13 +2920,6 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
         return md;
 }
 
-struct completion *dm_get_completion_from_kobject(struct kobject *kobj)
-{
-        struct mapped_device *md = container_of(kobj, struct mapped_device, kobj);
-
-        return &md->kobj_completion;
-}
-
 int dm_suspended_md(struct mapped_device *md)
 {
         return test_bit(DMF_SUSPENDED, &md->flags);