Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 177a99b2 authored by NeilBrown's avatar NeilBrown Committed by Linus Torvalds
Browse files

md: fix use-after-free bug when dropping an rdev from an md array 



Due to possible deadlock issues we need to use a schedule work to kobject_del
an 'rdev' object from a different thread.

A recent change means that kobject_add no longer gets a refernce, and
kobject_del doesn't put a reference.  Consequently, we need to explicitly hold
a reference to ensure that the last reference isn't dropped before the
scheduled work get a chance to call kobject_del.

Also, rename delayed_delete to md_delayed_delete to that it is more obvious in
a stack trace which code is to blame.

Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: default avatarNeil Brown <neilb@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent a17184a9

drivers/md/md.c

+5 −3
Original line number Diff line number Diff line
@@ -1419,10 +1419,11 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev) 
	return err;

}



static void delayed_delete(struct work_struct *ws)

static void md_delayed_delete(struct work_struct *ws)

{

	mdk_rdev_t *rdev = container_of(ws, mdk_rdev_t, del_work);

	kobject_del(&rdev->kobj);

	kobject_put(&rdev->kobj);

}



static void unbind_rdev_from_array(mdk_rdev_t * rdev)
@@ -1441,7 +1442,8 @@ static void unbind_rdev_from_array(mdk_rdev_t * rdev) 
	/* We need to delay this, otherwise we can deadlock when

	 * writing to 'remove' to "dev/state"

	 */

	INIT_WORK(&rdev->del_work, delayed_delete);

	INIT_WORK(&rdev->del_work, md_delayed_delete);

	kobject_get(&rdev->kobj);

	schedule_work(&rdev->del_work);

}
@@ -3686,7 +3688,7 @@ static int do_md_stop(mddev_t * mddev, int mode) 
				sysfs_remove_link(&mddev->kobj, nm);

			}



		/* make sure all delayed_delete calls have finished */

		/* make sure all md_delayed_delete calls have finished */

		flush_scheduled_work();



		export_array(mddev);