From be35f486108227e10fe5d96fd42fb2b344c59983 Mon Sep 17 00:00:00 2001 From: Mikulas Patocka Date: Mon, 6 Jan 2014 23:01:22 -0500 Subject: dm: wait until embedded kobject is released before destroying a device There may be other parts of the kernel holding a reference on the dm kobject. We must wait until all references are dropped before deallocating the mapped_device structure. The dm_kobject_release method signals that all references are dropped via completion. But dm_kobject_release doesn't free the kobject (which is embedded in the mapped_device structure). This is the sequence of operations: * when destroying a DM device, call kobject_put from dm_sysfs_exit * wait until all users stop using the kobject, when it happens the release method is called * the release method signals the completion and should return without delay * the dm device removal code that waits on the completion continues * the dm device removal code drops the dm_mod reference the device had * the dm device removal code frees the mapped_device structure that contains the kobject Using kobject this way should avoid the module unload race that was mentioned at the beginning of this thread: https://lkml.org/lkml/2014/1/4/83 Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Cc: stable@vger.kernel.org --- drivers/md/dm.c | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'drivers/md/dm.c') diff --git a/drivers/md/dm.c b/drivers/md/dm.c index b3d937211a48..e290e72922a4 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -203,6 +203,9 @@ struct mapped_device { /* sysfs handle */ struct kobject kobj; + /* wait until the kobject is released */ + struct completion kobj_completion; + /* zero-length flush that will be cloned and submitted to targets */ struct bio flush_bio; @@ -2041,6 +2044,7 @@ static struct mapped_device *alloc_dev(int minor) init_waitqueue_head(&md->wait); INIT_WORK(&md->work, dm_wq_work); init_waitqueue_head(&md->eventq); + init_completion(&md->kobj_completion); md->disk->major = _major; md->disk->first_minor = minor; @@ -2919,6 +2923,13 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj) return md; } +struct completion *dm_get_completion_from_kobject(struct kobject *kobj) +{ + struct mapped_device *md = container_of(kobj, struct mapped_device, kobj); + + return &md->kobj_completion; +} + int dm_suspended_md(struct mapped_device *md) { return test_bit(DMF_SUSPENDED, &md->flags); -- cgit v1.2.3