On Sat, Feb 08, 2014 at 04:08:29PM -0800, Greg Kroah-Hartman wrote:
>
> The patch below does not apply to the 3.10-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@xxxxxxxxxxxxxxx>.
>
> thanks,
>
> greg k-h
I've applied 1ddd641ddcfa46d719189468b6856e9b17381a61 ("dm: remove
pointless kobject comparison in dm_get_from_kobject") to the 3.11 kernel
before applying this patch. I believe it should be enough to fix this.
Cheers,
--
Luis
> ------------------ original commit in Linus's tree ------------------
>
> From 2995fa78e423d7193f3b57835f6c1c75006a0315 Mon Sep 17 00:00:00 2001
> From: Mikulas Patocka <mpatocka@xxxxxxxxxx>
> Date: Mon, 13 Jan 2014 19:37:54 -0500
> Subject: [PATCH] dm sysfs: fix a module unload race
>
> This reverts commit be35f48610 ("dm: wait until embedded kobject is
> released before destroying a device") and provides an improved fix.
>
> The kobject release code that calls the completion must be placed in a
> non-module file, otherwise there is a module unload race (if the process
> calling dm_kobject_release is preempted and the DM module unloaded after
> the completion is triggered, but before dm_kobject_release returns).
>
> To fix this race, this patch moves the completion code to dm-builtin.c
> which is always compiled directly into the kernel if BLK_DEV_DM is
> selected.
>
> The patch introduces a new dm_kobject_holder structure, its purpose is
> to keep the completion and kobject in one place, so that it can be
> accessed from non-module code without the need to export the layout of
> struct mapped_device to that code.
>
> Signed-off-by: Mikulas Patocka <mpatocka@xxxxxxxxxx>
> Signed-off-by: Mike Snitzer <snitzer@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
>
> diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
> index 39b540a13369..9a06fe883766 100644
> --- a/drivers/md/Kconfig
> +++ b/drivers/md/Kconfig
> @@ -176,8 +176,12 @@ config MD_FAULTY
>
> source "drivers/md/bcache/Kconfig"
>
> +config BLK_DEV_DM_BUILTIN
> + boolean
> +
> config BLK_DEV_DM
> tristate "Device mapper support"
> + select BLK_DEV_DM_BUILTIN
> ---help---
> Device-mapper is a low level volume manager. It works by allowing
> people to specify mappings for ranges of logical sectors. Various
> diff --git a/drivers/md/Makefile b/drivers/md/Makefile
> index 2acc43fe0229..f26d83292579 100644
> --- a/drivers/md/Makefile
> +++ b/drivers/md/Makefile
> @@ -32,6 +32,7 @@ obj-$(CONFIG_MD_FAULTY) += faulty.o
> obj-$(CONFIG_BCACHE) += bcache/
> obj-$(CONFIG_BLK_DEV_MD) += md-mod.o
> obj-$(CONFIG_BLK_DEV_DM) += dm-mod.o
> +obj-$(CONFIG_BLK_DEV_DM_BUILTIN) += dm-builtin.o
> obj-$(CONFIG_DM_BUFIO) += dm-bufio.o
> obj-$(CONFIG_DM_BIO_PRISON) += dm-bio-prison.o
> obj-$(CONFIG_DM_CRYPT) += dm-crypt.o
> diff --git a/drivers/md/dm-builtin.c b/drivers/md/dm-builtin.c
> new file mode 100644
> index 000000000000..6c9049c51b2b
> --- /dev/null
> +++ b/drivers/md/dm-builtin.c
> @@ -0,0 +1,48 @@
> +#include "dm.h"
> +
> +/*
> + * The kobject release method must not be placed in the module itself,
> + * otherwise we are subject to module unload races.
> + *
> + * The release method is called when the last reference to the kobject is
> + * dropped. It may be called by any other kernel code that drops the last
> + * reference.
> + *
> + * The release method suffers from module unload race. We may prevent the
> + * module from being unloaded at the start of the release method (using
> + * increased module reference count or synchronizing against the release
> + * method), however there is no way to prevent the module from being
> + * unloaded at the end of the release method.
> + *
> + * If this code were placed in the dm module, the following race may
> + * happen:
> + * 1. Some other process takes a reference to dm kobject
> + * 2. The user issues ioctl function to unload the dm device
> + * 3. dm_sysfs_exit calls kobject_put, however the object is not released
> + * because of the other reference taken at step 1
> + * 4. dm_sysfs_exit waits on the completion
> + * 5. The other process that took the reference in step 1 drops it,
> + * dm_kobject_release is called from this process
> + * 6. dm_kobject_release calls complete()
> + * 7. a reschedule happens before dm_kobject_release returns
> + * 8. dm_sysfs_exit continues, the dm device is unloaded, module reference
> + * count is decremented
> + * 9. The user unloads the dm module
> + * 10. The other process that was rescheduled in step 7 continues to run,
> + * it is now executing code in unloaded module, so it crashes
> + *
> + * Note that if the process that takes the foreign reference to dm kobject
> + * has a low priority and the system is sufficiently loaded with
> + * higher-priority processes that prevent the low-priority process from
> + * being scheduled long enough, this bug may really happen.
> + *
> + * In order to fix this module unload race, we place the release method
> + * into a helper code that is compiled directly into the kernel.
> + */
> +
> +void dm_kobject_release(struct kobject *kobj)
> +{
> + complete(dm_get_completion_from_kobject(kobj));
> +}
> +
> +EXPORT_SYMBOL(dm_kobject_release);
> diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c
> index e0cc5d6a9e46..c62c5ab6aed5 100644
> --- a/drivers/md/dm-sysfs.c
> +++ b/drivers/md/dm-sysfs.c
> @@ -79,11 +79,6 @@ static const struct sysfs_ops dm_sysfs_ops = {
> .show = dm_attr_show,
> };
>
> -static void dm_kobject_release(struct kobject *kobj)
> -{
> - complete(dm_get_completion_from_kobject(kobj));
> -}
> -
> /*
> * dm kobject is embedded in mapped_device structure
> * no need to define release function here
> diff --git a/drivers/md/dm.c b/drivers/md/dm.c
> index e290e72922a4..b49c76284241 100644
> --- a/drivers/md/dm.c
> +++ b/drivers/md/dm.c
> @@ -200,11 +200,8 @@ struct mapped_device {
> /* forced geometry settings */
> struct hd_geometry geometry;
>
> - /* sysfs handle */
> - struct kobject kobj;
> -
> - /* wait until the kobject is released */
> - struct completion kobj_completion;
> + /* kobject and completion */
> + struct dm_kobject_holder kobj_holder;
>
> /* zero-length flush that will be cloned and submitted to targets */
> struct bio flush_bio;
> @@ -2044,7 +2041,7 @@ static struct mapped_device *alloc_dev(int minor)
> init_waitqueue_head(&md->wait);
> INIT_WORK(&md->work, dm_wq_work);
> init_waitqueue_head(&md->eventq);
> - init_completion(&md->kobj_completion);
> + init_completion(&md->kobj_holder.completion);
>
> md->disk->major = _major;
> md->disk->first_minor = minor;
> @@ -2906,14 +2903,14 @@ struct gendisk *dm_disk(struct mapped_device *md)
>
> struct kobject *dm_kobject(struct mapped_device *md)
> {
> - return &md->kobj;
> + return &md->kobj_holder.kobj;
> }
>
> struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
> {
> struct mapped_device *md;
>
> - md = container_of(kobj, struct mapped_device, kobj);
> + md = container_of(kobj, struct mapped_device, kobj_holder.kobj);
>
> if (test_bit(DMF_FREEING, &md->flags) ||
> dm_deleting_md(md))
> @@ -2923,13 +2920,6 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
> return md;
> }
>
> -struct completion *dm_get_completion_from_kobject(struct kobject *kobj)
> -{
> - struct mapped_device *md = container_of(kobj, struct mapped_device, kobj);
> -
> - return &md->kobj_completion;
> -}
> -
> int dm_suspended_md(struct mapped_device *md)
> {
> return test_bit(DMF_SUSPENDED, &md->flags);
> diff --git a/drivers/md/dm.h b/drivers/md/dm.h
> index 1ab2028559ca..c4569f02f50f 100644
> --- a/drivers/md/dm.h
> +++ b/drivers/md/dm.h
> @@ -16,6 +16,7 @@
> #include <linux/blkdev.h>
> #include <linux/hdreg.h>
> #include <linux/completion.h>
> +#include <linux/kobject.h>
>
> #include "dm-stats.h"
>
> @@ -149,11 +150,25 @@ void dm_interface_exit(void);
> /*
> * sysfs interface
> */
> +struct dm_kobject_holder {
> + struct kobject kobj;
> + struct completion completion;
> +};
> +
> +static inline struct completion *dm_get_completion_from_kobject(struct kobject *kobj)
> +{
> + return &container_of(kobj, struct dm_kobject_holder, kobj)->completion;
> +}
> +
> int dm_sysfs_init(struct mapped_device *md);
> void dm_sysfs_exit(struct mapped_device *md);
> struct kobject *dm_kobject(struct mapped_device *md);
> struct mapped_device *dm_get_from_kobject(struct kobject *kobj);
> -struct completion *dm_get_completion_from_kobject(struct kobject *kobj);
> +
> +/*
> + * The kobject helper
> + */
> +void dm_kobject_release(struct kobject *kobj);
>
> /*
> * Targets for linear and striped mappings
>
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html