Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 570b9d96 authored by Alasdair G Kergon's avatar Alasdair G Kergon
Browse files

dm table: fix upgrade mode race 



upgrade_mode() sets bdev to NULL temporarily, and does not have any
locking to exclude anything from seeing that NULL.

In dm_table_any_congested() bdev_get_queue() can dereference that NULL and
cause a reported oops.

Fix this by not changing that field during the mode upgrade.

Cc: stable@kernel.org
Cc: Neil Brown <neilb@suse.de>
Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
parent aea90588

drivers/md/dm-table.c

+14 −12
Original line number Diff line number Diff line
@@ -399,28 +399,30 @@ static int check_device_area(struct dm_dev_internal *dd, sector_t start, 
}



/*

 * This upgrades the mode on an already open dm_dev.  Being

 * This upgrades the mode on an already open dm_dev, being

 * careful to leave things as they were if we fail to reopen the

 * device.

 * device and not to touch the existing bdev field in case

 * it is accessed concurrently inside dm_table_any_congested().

 */

static int upgrade_mode(struct dm_dev_internal *dd, fmode_t new_mode,

			struct mapped_device *md)

{

	int r;

	struct dm_dev_internal dd_copy;

	dev_t dev = dd->dm_dev.bdev->bd_dev;

	struct dm_dev_internal dd_new, dd_old;



	dd_copy = *dd;

	dd_new = dd_old = *dd;



	dd->dm_dev.mode |= new_mode;

	dd->dm_dev.bdev = NULL;

	r = open_dev(dd, dev, md);

	if (!r)

		close_dev(&dd_copy, md);

	else

		*dd = dd_copy;

	dd_new.dm_dev.mode |= new_mode;

	dd_new.dm_dev.bdev = NULL;



	r = open_dev(&dd_new, dd->dm_dev.bdev->bd_dev, md);

	if (r)

		return r;



	dd->dm_dev.mode |= new_mode;

	close_dev(&dd_old, md);



	return 0;

}



/*