• K
    dm: prevent access to md being deleted · abdc568b
    Kiyoshi Ueda 提交于
    This patch prevents access to mapped_device which is being deleted.
    
    Currently, even after a mapped_device has been removed from the hash,
    it could be accessed through idr_find() using minor number.
    That could cause a race and NULL pointer reference below:
      CPU0                          CPU1
      ------------------------------------------------------------------
      dev_remove(param)
        down_write(_hash_lock)
        dm_lock_for_deletion(md)
          spin_lock(_minor_lock)
          set_bit(DMF_DELETING)
          spin_unlock(_minor_lock)
        __hash_remove(hc)
        up_write(_hash_lock)
                                    dev_status(param)
                                      md = find_device(param)
                                             down_read(_hash_lock)
                                             __find_device_hash_cell(param)
                                               dm_get_md(param->dev)
                                                 md = dm_find_md(dev)
                                                        spin_lock(_minor_lock)
                                                        md = idr_find(MINOR(dev))
                                                        spin_unlock(_minor_lock)
        dm_put(md)
          free_dev(md)
                                                 dm_get(md)
                                             up_read(_hash_lock)
                                      __dev_status(md, param)
                                      dm_put(md)
    
    This patch fixes such problems.
    Signed-off-by: NKiyoshi Ueda <k-ueda@ct.jp.nec.com>
    Signed-off-by: NJun'ichi Nomura <j-nomura@ce.jp.nec.com>
    Cc: stable@kernel.org
    Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
    abdc568b
dm.c 60.8 KB