Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed01e50a authored by Dan Williams's avatar Dan Williams Committed by Greg Kroah-Hartman
Browse files

device-dax: fix cdev leak 



If device_add() fails, cleanup the cdev. Otherwise, we leak a kobj_map()
with a stale device number.

As Jason points out, there is a small possibility that userspace has
opened and mapped the device in the time between cdev_add() and the
device_add() failure. We need a new kill_dax_dev() helper to invalidate
any established mappings.

Fixes: ba09c01d ("dax: convert to the cdev api")
Cc: <stable@vger.kernel.org>
Reported-by: default avatarJason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
Signed-off-by: default avatarLogan Gunthorpe <logang@deltatee.com>
Reviewed-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 233ed09d

drivers/dax/dax.c

+11 −4
Original line number Diff line number Diff line
@@ -675,13 +675,10 @@ static void dax_dev_release(struct device *dev) 
	kfree(dax_dev);

}



static void unregister_dax_dev(void *dev)

static void kill_dax_dev(struct dax_dev *dax_dev)

{

	struct dax_dev *dax_dev = to_dax_dev(dev);

	struct cdev *cdev = &dax_dev->cdev;



	dev_dbg(dev, "%s\n", __func__);



	/*

	 * Note, rcu is not protecting the liveness of dax_dev, rcu is

	 * ensuring that any fault handlers that might have seen
@@ -693,6 +690,15 @@ static void unregister_dax_dev(void *dev) 
	synchronize_rcu();

	unmap_mapping_range(dax_dev->inode->i_mapping, 0, 0, 1);

	cdev_del(cdev);

}



static void unregister_dax_dev(void *dev)

{

	struct dax_dev *dax_dev = to_dax_dev(dev);



	dev_dbg(dev, "%s\n", __func__);



	kill_dax_dev(dax_dev);

	device_unregister(dev);

}
@@ -769,6 +775,7 @@ struct dax_dev *devm_create_dax_dev(struct dax_region *dax_region, 
	dev_set_name(dev, "dax%d.%d", dax_region->id, dax_dev->id);

	rc = device_add(dev);

	if (rc) {

		kill_dax_dev(dax_dev);

		put_device(dev);

		return ERR_PTR(rc);

	}