Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 39a169b6 authored by Roman Pen's avatar Roman Pen Committed by Jens Axboe
Browse files

block: fix module reference leak on put_disk() call for cgroups throttle 



get_disk(),get_gendisk() calls have non explicit side effect: they
increase the reference on the disk owner module.

The following is the correct sequence how to get a disk reference and
to put it:

    disk = get_gendisk(...);

    /* use disk */

    owner = disk->fops->owner;
    put_disk(disk);
    module_put(owner);

fs/block_dev.c is aware of this required module_put() call, but f.e.
blkg_conf_finish(), which is located in block/blk-cgroup.c, does not put
a module reference.  To see a leakage in action cgroups throttle config
can be used.  In the following script I'm removing throttle for /dev/ram0
(actually this is NOP, because throttle was never set for this device):

    # lsmod | grep brd
    brd                     5175  0
    # i=100; while [ $i -gt 0 ]; do echo "1:0 0" > \
        /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device; i=$(($i - 1)); \
    done
    # lsmod | grep brd
    brd                     5175  100

Now brd module has 100 references.

The issue is fixed by calling module_put() just right away put_disk().

Signed-off-by: default avatarRoman Pen <roman.penyaev@profitbricks.com>
Cc: Gi-Oh Kim <gi-oh.kim@profitbricks.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: linux-block@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: default avatarJens Axboe <axboe@fb.com>
parent 21d14788

block/blk-cgroup.c

+9 −0
Original line number Original line Diff line number Diff line
@@ -788,6 +788,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, 
{

{

	struct gendisk *disk;

	struct gendisk *disk;

	struct blkcg_gq *blkg;

	struct blkcg_gq *blkg;

	struct module *owner;

	unsigned int major, minor;

	unsigned int major, minor;

	int key_len, part, ret;

	int key_len, part, ret;

	char *body;

	char *body;
@@ -804,7 +805,9 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, 
	if (!disk)

	if (!disk)

		return -ENODEV;

		return -ENODEV;

	if (part) {

	if (part) {

		owner = disk->fops->owner;

		put_disk(disk);

		put_disk(disk);

		module_put(owner);

		return -ENODEV;

		return -ENODEV;

	}

	}
@@ -820,7 +823,9 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, 
		ret = PTR_ERR(blkg);

		ret = PTR_ERR(blkg);

		rcu_read_unlock();

		rcu_read_unlock();

		spin_unlock_irq(disk->queue->queue_lock);

		spin_unlock_irq(disk->queue->queue_lock);

		owner = disk->fops->owner;

		put_disk(disk);

		put_disk(disk);

		module_put(owner);

		/*

		/*

		 * If queue was bypassing, we should retry.  Do so after a

		 * If queue was bypassing, we should retry.  Do so after a

		 * short msleep().  It isn't strictly necessary but queue

		 * short msleep().  It isn't strictly necessary but queue
@@ -851,9 +856,13 @@ EXPORT_SYMBOL_GPL(blkg_conf_prep); 
void blkg_conf_finish(struct blkg_conf_ctx *ctx)

void blkg_conf_finish(struct blkg_conf_ctx *ctx)

	__releases(ctx->disk->queue->queue_lock) __releases(rcu)

	__releases(ctx->disk->queue->queue_lock) __releases(rcu)

{

{

	struct module *owner;



	spin_unlock_irq(ctx->disk->queue->queue_lock);

	spin_unlock_irq(ctx->disk->queue->queue_lock);

	rcu_read_unlock();

	rcu_read_unlock();

	owner = ctx->disk->fops->owner;

	put_disk(ctx->disk);

	put_disk(ctx->disk);

	module_put(owner);

}

}

EXPORT_SYMBOL_GPL(blkg_conf_finish);

EXPORT_SYMBOL_GPL(blkg_conf_finish);