diff options
| author | Kiyoshi Ueda <k-ueda@ct.jp.nec.com> | 2010-08-12 04:13:54 +0100 |
|---|---|---|
| committer | Alasdair G Kergon <agk@redhat.com> | 2010-08-12 04:13:54 +0100 |
| commit | abdc568b0540bec6d3e0afebac496adef1189b77 (patch) | |
| tree | 1c88c8de6e90b7f9cbbc788fa9e3fb539f1d231c /drivers/md/dm.c | |
| parent | 856a6f1dbd8940e72755af145ebcd806408ecedd (diff) | |
| download | linux-abdc568b0540bec6d3e0afebac496adef1189b77.tar.gz linux-abdc568b0540bec6d3e0afebac496adef1189b77.tar.bz2 linux-abdc568b0540bec6d3e0afebac496adef1189b77.zip | |
dm: prevent access to md being deleted
This patch prevents access to mapped_device which is being deleted.
Currently, even after a mapped_device has been removed from the hash,
it could be accessed through idr_find() using minor number.
That could cause a race and NULL pointer reference below:
CPU0 CPU1
------------------------------------------------------------------
dev_remove(param)
down_write(_hash_lock)
dm_lock_for_deletion(md)
spin_lock(_minor_lock)
set_bit(DMF_DELETING)
spin_unlock(_minor_lock)
__hash_remove(hc)
up_write(_hash_lock)
dev_status(param)
md = find_device(param)
down_read(_hash_lock)
__find_device_hash_cell(param)
dm_get_md(param->dev)
md = dm_find_md(dev)
spin_lock(_minor_lock)
md = idr_find(MINOR(dev))
spin_unlock(_minor_lock)
dm_put(md)
free_dev(md)
dm_get(md)
up_read(_hash_lock)
__dev_status(md, param)
dm_put(md)
This patch fixes such problems.
Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Cc: stable@kernel.org
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Diffstat (limited to 'drivers/md/dm.c')
| -rw-r--r-- | drivers/md/dm.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/md/dm.c b/drivers/md/dm.c index a3f21dc02bd8..ba6934c3e2c5 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2136,6 +2136,7 @@ static struct mapped_device *dm_find_md(dev_t dev) md = idr_find(&_minor_idr, minor); if (md && (md == MINOR_ALLOCED || (MINOR(disk_devt(dm_disk(md))) != minor) || + dm_deleting_md(md) || test_bit(DMF_FREEING, &md->flags))) { md = NULL; goto out; |