Patch "dax: Fix dax_mapping_release() use after free" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    dax: Fix dax_mapping_release() use after free

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     dax-fix-dax_mapping_release-use-after-free.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 404e2a24c459b0c3a26250a002c31ac542e0e3c7
Author: Dan Williams <dan.j.williams@xxxxxxxxx>
Date:   Fri Jun 2 23:13:54 2023 -0700

    dax: Fix dax_mapping_release() use after free
    
    [ Upstream commit 6d24b170a9db0456f577b1ab01226a2254c016a8 ]
    
    A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region
    provider (like modprobe -r dax_hmem) yields:
    
     kobject: 'mapping0' (ffff93eb460e8800): kobject_release, parent 0000000000000000 (delayed 2000)
     [..]
     DEBUG_LOCKS_WARN_ON(1)
     WARNING: CPU: 23 PID: 282 at kernel/locking/lockdep.c:232 __lock_acquire+0x9fc/0x2260
     [..]
     RIP: 0010:__lock_acquire+0x9fc/0x2260
     [..]
     Call Trace:
      <TASK>
     [..]
      lock_acquire+0xd4/0x2c0
      ? ida_free+0x62/0x130
      _raw_spin_lock_irqsave+0x47/0x70
      ? ida_free+0x62/0x130
      ida_free+0x62/0x130
      dax_mapping_release+0x1f/0x30
      device_release+0x36/0x90
      kobject_delayed_cleanup+0x46/0x150
    
    Due to attempting ida_free() on an ida object that has already been
    freed. Devices typically only hold a reference on their parent while
    registered. If a child needs a parent object to complete its release it
    needs to hold a reference that it drops from its release callback.
    Arrange for a dax_mapping to pin its parent dev_dax instance until
    dax_mapping_release().
    
    Fixes: 0b07ce872a9e ("device-dax: introduce 'mapping' devices")
    Signed-off-by: Dan Williams <dan.j.williams@xxxxxxxxx>
    Link: https://lore.kernel.org/r/168577283412.1672036.16111545266174261446.stgit@xxxxxxxxxxxxxxxxxxxxxxxxx
    Reviewed-by: Dave Jiang <dave.jiang@xxxxxxxxx>
    Reviewed-by: Fan Ni <fan.ni@xxxxxxxxxxx>
    Reviewed-by: Ira Weiny <ira.weiny@xxxxxxxxx>
    Signed-off-by: Vishal Verma <vishal.l.verma@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
index e75b9edc88a1f..ce010040bcef8 100644
--- a/drivers/dax/bus.c
+++ b/drivers/dax/bus.c
@@ -591,10 +591,12 @@ EXPORT_SYMBOL_GPL(alloc_dax_region);
 static void dax_mapping_release(struct device *dev)
 {
 	struct dax_mapping *mapping = to_dax_mapping(dev);
-	struct dev_dax *dev_dax = to_dev_dax(dev->parent);
+	struct device *parent = dev->parent;
+	struct dev_dax *dev_dax = to_dev_dax(parent);
 
 	ida_free(&dev_dax->ida, mapping->id);
 	kfree(mapping);
+	put_device(parent);
 }
 
 static void unregister_dax_mapping(void *data)
@@ -734,6 +736,7 @@ static int devm_register_dax_mapping(struct dev_dax *dev_dax, int range_id)
 	dev = &mapping->dev;
 	device_initialize(dev);
 	dev->parent = &dev_dax->dev;
+	get_device(dev->parent);
 	dev->type = &dax_mapping_type;
 	dev_set_name(dev, "mapping%d", mapping->id);
 	rc = device_add(dev);



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux