Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2b486298 authored by Ilya Dryomov's avatar Ilya Dryomov Committed by Greg Kroah-Hartman
Browse files

rbd: call rbd_dev_unprobe() after unwatching and flushing notifies 



[ Upstream commit 952c48b0ed18919bff7528501e9a3fff8a24f8cd ]

rbd_dev_unprobe() is supposed to undo most of rbd_dev_image_probe(),
including rbd_dev_header_info(), which means that rbd_dev_header_info()
isn't supposed to be called after rbd_dev_unprobe().

However, rbd_dev_image_release() calls rbd_dev_unprobe() before
rbd_unregister_watch().  This is racy because a header update notify
can sneak in:

  "rbd unmap" thread                   ceph-watch-notify worker

  rbd_dev_image_release()
    rbd_dev_unprobe()
      free and zero out header
                                       rbd_watch_cb()
                                         rbd_dev_refresh()
                                           rbd_dev_header_info()
                                             read in header

The same goes for "rbd map" because rbd_dev_image_probe() calls
rbd_dev_unprobe() on errors.  In both cases this results in a memory
leak.

Fixes: fd22aef8 ("rbd: move rbd_unregister_watch() call into rbd_dev_image_release()")
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
Reviewed-by: default avatarJason Dillaman <dillaman@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 26b69a33

drivers/block/rbd.c

+4 −4
Original line number Diff line number Diff line
@@ -5723,9 +5723,10 @@ static int rbd_dev_header_name(struct rbd_device *rbd_dev) 


static void rbd_dev_image_release(struct rbd_device *rbd_dev)

{

	rbd_dev_unprobe(rbd_dev);

	if (rbd_dev->opts)

		rbd_unregister_watch(rbd_dev);



	rbd_dev_unprobe(rbd_dev);

	rbd_dev->image_format = 0;

	kfree(rbd_dev->spec->image_id);

	rbd_dev->spec->image_id = NULL;
@@ -5776,7 +5777,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth) 


	ret = rbd_dev_header_info(rbd_dev);

	if (ret)

		goto err_out_watch;

		goto err_out_probe;



	/*

	 * If this image is the one being mapped, we have pool name and
@@ -5822,12 +5823,11 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth) 
	return 0;



err_out_probe:

	rbd_dev_unprobe(rbd_dev);

err_out_watch:

	if (!depth)

		up_write(&rbd_dev->header_rwsem);

	if (!depth)

		rbd_unregister_watch(rbd_dev);

	rbd_dev_unprobe(rbd_dev);

err_out_format:

	rbd_dev->image_format = 0;

	kfree(rbd_dev->spec->image_id);