aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/md/md.c
diff options
context:
space:
mode:
authorNeilBrown <neilb@suse.de>2008-02-06 04:39:56 -0500
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2008-02-06 13:41:19 -0500
commit177a99b23ef9878c0cedcc7273108eba8a6e9472 (patch)
tree616dd718e94a1e5e8ca536114d5fb91fa780bbc8 /drivers/md/md.c
parenta17184a911195c274104df98a79bec10f57e735d (diff)
md: fix use-after-free bug when dropping an rdev from an md array
Due to possible deadlock issues we need to use a schedule work to kobject_del an 'rdev' object from a different thread. A recent change means that kobject_add no longer gets a refernce, and kobject_del doesn't put a reference. Consequently, we need to explicitly hold a reference to ensure that the last reference isn't dropped before the scheduled work get a chance to call kobject_del. Also, rename delayed_delete to md_delayed_delete to that it is more obvious in a stack trace which code is to blame. Cc: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/md/md.c')
-rw-r--r--drivers/md/md.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 08e0f8d672c3..6cdd1b4faca6 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1419,10 +1419,11 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
1419 return err; 1419 return err;
1420} 1420}
1421 1421
1422static void delayed_delete(struct work_struct *ws) 1422static void md_delayed_delete(struct work_struct *ws)
1423{ 1423{
1424 mdk_rdev_t *rdev = container_of(ws, mdk_rdev_t, del_work); 1424 mdk_rdev_t *rdev = container_of(ws, mdk_rdev_t, del_work);
1425 kobject_del(&rdev->kobj); 1425 kobject_del(&rdev->kobj);
1426 kobject_put(&rdev->kobj);
1426} 1427}
1427 1428
1428static void unbind_rdev_from_array(mdk_rdev_t * rdev) 1429static void unbind_rdev_from_array(mdk_rdev_t * rdev)
@@ -1441,7 +1442,8 @@ static void unbind_rdev_from_array(mdk_rdev_t * rdev)
1441 /* We need to delay this, otherwise we can deadlock when 1442 /* We need to delay this, otherwise we can deadlock when
1442 * writing to 'remove' to "dev/state" 1443 * writing to 'remove' to "dev/state"
1443 */ 1444 */
1444 INIT_WORK(&rdev->del_work, delayed_delete); 1445 INIT_WORK(&rdev->del_work, md_delayed_delete);
1446 kobject_get(&rdev->kobj);
1445 schedule_work(&rdev->del_work); 1447 schedule_work(&rdev->del_work);
1446} 1448}
1447 1449
@@ -3686,7 +3688,7 @@ static int do_md_stop(mddev_t * mddev, int mode)
3686 sysfs_remove_link(&mddev->kobj, nm); 3688 sysfs_remove_link(&mddev->kobj, nm);
3687 } 3689 }
3688 3690
3689 /* make sure all delayed_delete calls have finished */ 3691 /* make sure all md_delayed_delete calls have finished */
3690 flush_scheduled_work(); 3692 flush_scheduled_work();
3691 3693
3692 export_array(mddev); 3694 export_array(mddev);