• M
    tcmu: fix crash during device removal · f3cdbe39
    Mike Christie 提交于
    We currently do
    
    tcmu_free_device ->tcmu_netlink_event(TCMU_CMD_REMOVED_DEVICE) ->
    uio_unregister_device -> kfree(tcmu_dev).
    
    The problem is that the kernel does not wait for userspace to
    do the close() on the uio device before freeing the tcmu_dev.
    We can then hit a race where the kernel frees the tcmu_dev before
    userspace does close() and so when close() -> release -> tcmu_release
    is done, we try to access a freed tcmu_dev.
    
    This patch made over the target-pending master branch moves the freeing
    of the tcmu_dev to when the last reference has been dropped.
    
    This also fixes a leak where if tcmu_configure_device was not called on a
    device we did not free udev->name which was allocated at tcmu_alloc_device time.
    Signed-off-by: NMike Christie <mchristi@redhat.com>
    Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
    f3cdbe39
target_core_user.c 42.7 KB