sysfs: implement sysfs_dirent active reference and immediate disconnect

sysfs: implement sysfs_dirent active reference and immediate disconnect

Opening a sysfs node references its associated kobject, so userland
can arbitrarily prolong lifetime of a kobject which complicates
lifetime rules in drivers.  This patch implements active reference and
makes the association between kobject and sysfs immediately breakable.

Now each sysfs_dirent has two reference counts - s_count and s_active.
s_count is a regular reference count which guarantees that the
containing sysfs_dirent is accessible.  As long as s_count reference
is held, all sysfs internal fields in sysfs_dirent are accessible
including s_parent and s_name.

The newly added s_active is active reference count.  This is acquired
by invoking sysfs_get_active() and it's the caller's responsibility to
ensure sysfs_dirent itself is accessible (should be holding s_count
one way or the other).  Dereferencing sysfs_dirent to access objects
out of sysfs proper requires active reference.  This includes access
to the associated kobjects, attributes and ops.

The active references can be drained and denied by calling
sysfs_deactivate().  All active sysfs_dirents must be deactivated
after deletion but before the default reference is dropped.  This
enables immediate disconnect of sysfs nodes.  Once a sysfs_dirent is
deleted, it won't access any entity external to sysfs proper.

Because attr/bin_attr ops access both the node itself and its parent
for kobject, they need to hold active references to both.
sysfs_get/put_active_two() helpers are provided to help grabbing both
references.  Parent's is acquired first and released last.

Unlike other operations, mmapped area lingers on after mmap() is
finished and the module implement implementing it and kobj need to
stay referenced till all the mapped pages are gone.  This is
accomplished by holding one set of active references to the bin_attr
and its parent if there have been any mmap during lifetime of an
openfile.  The references are dropped when the openfile is released.

This change makes sysfs lifetime rules independent from both kobject's
and module's.  It not only fixes several race conditions caused by
sysfs not holding onto the proper module when referencing kobject, but
also helps fixing and simplifying lifetime management in driver model
and drivers by taking sysfs out of the equation.

Please read the following message for more info.

  http://article.gmane.org/gmane.linux.kernel/510293

Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 102 insertions, 21 deletions

diff --git a/fs/sysfs/sysfs.h b/fs/sysfs/sysfs.h
index 60717660ac55..d998e8e27841 100644
--- a/fs/sysfs/sysfs.h
+++ b/fs/sysfs/sysfs.h
@@ -14,8 +14,14 @@ struct sysfs_elem_bin_attr {
         struct bin_attribute    * bin_attr;
 };
 
+/*
+ * As long as s_count reference is held, the sysfs_dirent itself is
+ * accessible.  Dereferencing s_elem or any other outer entity
+ * requires s_active reference.
+ */
 struct sysfs_dirent {
         atomic_t                s_count;
+        struct rw_semaphore     s_active;
         struct sysfs_dirent     * s_parent;
         struct list_head        s_sibling;
         struct list_head        s_children;
@@ -36,6 +42,17 @@ struct sysfs_dirent {
         atomic_t                s_event;
 };
 
+/*
+ * A sysfs file which deletes another file when written to need to
+ * write lock the s_active of the victim while its s_active is read
+ * locked for the write operation.  Tell lockdep that this is okay.
+ */
+enum sysfs_s_active_class
+{
+        SYSFS_S_ACTIVE_NORMAL,          /* file r/w access, etc - default */
+        SYSFS_S_ACTIVE_DEACTIVATE,      /* file deactivation */
+};
+
 extern struct vfsmount * sysfs_mount;
 extern struct kmem_cache *sysfs_dir_cachep;
 
@@ -87,43 +104,107 @@ struct sysfs_buffer_collection {
         struct list_head        associates;
 };
 
-static inline struct kobject * to_kobj(struct dentry * dentry)
+static inline struct sysfs_dirent * sysfs_get(struct sysfs_dirent * sd)
 {
-        struct sysfs_dirent * sd = dentry->d_fsdata;
-        return sd->s_elem.dir.kobj;
+        if (sd) {
+                WARN_ON(!atomic_read(&sd->s_count));
+                atomic_inc(&sd->s_count);
+        }
+        return sd;
 }
 
-static inline struct kobject *sysfs_get_kobject(struct dentry *dentry)
+static inline void sysfs_put(struct sysfs_dirent * sd)
 {
-        struct kobject * kobj = NULL;
-
-        spin_lock(&dcache_lock);
-        if (!d_unhashed(dentry)) {
-                struct sysfs_dirent * sd = dentry->d_fsdata;
-
-                if (sd->s_type & SYSFS_KOBJ_LINK)
-                        sd = sd->s_elem.symlink.target_sd;
+        if (sd && atomic_dec_and_test(&sd->s_count))
+                release_sysfs_dirent(sd);
+}
 
-                kobj = kobject_get(sd->s_elem.dir.kobj);
+/**
+ *      sysfs_get_active - get an active reference to sysfs_dirent
+ *      @sd: sysfs_dirent to get an active reference to
+ *
+ *      Get an active reference of @sd.  This function is noop if @sd
+ *      is NULL.
+ *
+ *      RETURNS:
+ *      Pointer to @sd on success, NULL on failure.
+ */
+static inline struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd)
+{
+        if (sd) {
+                if (unlikely(!down_read_trylock(&sd->s_active)))
+                        sd = NULL;
         }
-        spin_unlock(&dcache_lock);
+        return sd;
+}
 
-        return kobj;
+/**
+ *      sysfs_put_active - put an active reference to sysfs_dirent
+ *      @sd: sysfs_dirent to put an active reference to
+ *
+ *      Put an active reference to @sd.  This function is noop if @sd
+ *      is NULL.
+ */
+static inline void sysfs_put_active(struct sysfs_dirent *sd)
+{
+        if (sd)
+                up_read(&sd->s_active);
 }
 
-static inline struct sysfs_dirent * sysfs_get(struct sysfs_dirent * sd)
+/**
+ *      sysfs_get_active_two - get active references to sysfs_dirent and parent
+ *      @sd: sysfs_dirent of interest
+ *
+ *      Get active reference to @sd and its parent.  Parent's active
+ *      reference is grabbed first.  This function is noop if @sd is
+ *      NULL.
+ *
+ *      RETURNS:
+ *      Pointer to @sd on success, NULL on failure.
+ */
+static inline struct sysfs_dirent *sysfs_get_active_two(struct sysfs_dirent *sd)
 {
         if (sd) {
-                WARN_ON(!atomic_read(&sd->s_count));
-                atomic_inc(&sd->s_count);
+                if (sd->s_parent && unlikely(!sysfs_get_active(sd->s_parent)))
+                        return NULL;
+                if (unlikely(!sysfs_get_active(sd))) {
+                        sysfs_put_active(sd->s_parent);
+                        return NULL;
+                }
         }
         return sd;
 }
 
-static inline void sysfs_put(struct sysfs_dirent * sd)
+/**
+ *      sysfs_put_active_two - put active references to sysfs_dirent and parent
+ *      @sd: sysfs_dirent of interest
+ *
+ *      Put active references to @sd and its parent.  This function is
+ *      noop if @sd is NULL.
+ */
+static inline void sysfs_put_active_two(struct sysfs_dirent *sd)
 {
-        if (sd && atomic_dec_and_test(&sd->s_count))
-                release_sysfs_dirent(sd);
+        if (sd) {
+                sysfs_put_active(sd);
+                sysfs_put_active(sd->s_parent);
+        }
+}
+
+/**
+ *      sysfs_deactivate - deactivate sysfs_dirent
+ *      @sd: sysfs_dirent to deactivate
+ *
+ *      Deny new active references and drain existing ones.  s_active
+ *      will be unlocked when the sysfs_dirent is released.
+ */
+static inline void sysfs_deactivate(struct sysfs_dirent *sd)
+{
+        down_write_nested(&sd->s_active, SYSFS_S_ACTIVE_DEACTIVATE);
+
+        /* s_active will be unlocked by the thread doing the final put
+         * on @sd.  Lie to lockdep.
+         */
+        rwsem_release(&sd->s_active.dep_map, 1, _RET_IP_);
 }
 
 static inline int sysfs_is_shadowed_inode(struct inode *inode)