leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
abdc568b05
linux/drivers/md
History
Kiyoshi Ueda abdc568b05 dm: prevent access to md being deleted 
This patch prevents access to mapped_device which is being deleted.

Currently, even after a mapped_device has been removed from the hash,
it could be accessed through idr_find() using minor number.
That could cause a race and NULL pointer reference below:
  CPU0                          CPU1
  ------------------------------------------------------------------
  dev_remove(param)
    down_write(_hash_lock)
    dm_lock_for_deletion(md)
      spin_lock(_minor_lock)
      set_bit(DMF_DELETING)
      spin_unlock(_minor_lock)
    __hash_remove(hc)
    up_write(_hash_lock)
                                dev_status(param)
                                  md = find_device(param)
                                         down_read(_hash_lock)
                                         __find_device_hash_cell(param)
                                           dm_get_md(param->dev)
                                             md = dm_find_md(dev)
                                                    spin_lock(_minor_lock)
                                                    md = idr_find(MINOR(dev))
                                                    spin_unlock(_minor_lock)
    dm_put(md)
      free_dev(md)
                                             dm_get(md)
                                         up_read(_hash_lock)
                                  __dev_status(md, param)
                                  dm_put(md)

This patch fixes such problems.

Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Cc: stable@kernel.org
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2010-08-12 04:13:54 +01:00
..
.gitignore
bitmap.c md/bitmap: separate out loading a bitmap from initialising the structures. 2010-07-26 13:21:34 +10:00
bitmap.h md/bitmap: separate out loading a bitmap from initialising the structures. 2010-07-26 13:21:34 +10:00
dm-bio-record.h
dm-crypt.c dm table: remove unused dm_get_device range parameters 2010-03-06 02:32:27 +00:00
dm-delay.c dm table: remove unused dm_get_device range parameters 2010-03-06 02:32:27 +00:00
dm-exception-store.c dm snapshot: test chunk size against both origin and snapshot 2010-08-12 04:13:51 +01:00
dm-exception-store.h dm snapshot: test chunk size against both origin and snapshot 2010-08-12 04:13:51 +01:00
dm-io.c block: unify flags for struct bio and struct request 2010-08-07 18:20:39 +02:00
dm-ioctl.c dm ioctl: return uevent flag after rename 2010-08-12 04:13:53 +01:00
dm-kcopyd.c block: unify flags for struct bio and struct request 2010-08-07 18:20:39 +02:00
dm-linear.c dm table: remove unused dm_get_device range parameters 2010-03-06 02:32:27 +00:00
dm-log-userspace-base.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
dm-log-userspace-transfer.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
dm-log-userspace-transfer.h dm log: userspace add luid to distinguish between concurrent log instances 2009-09-04 20:40:34 +01:00
dm-log.c dm table: remove unused dm_get_device range parameters 2010-03-06 02:32:27 +00:00
dm-mpath.c dm mpath: fix NULL pointer dereference when path parameters missing 2010-08-12 04:13:49 +01:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h dm mpath: add start_io and nr_bytes to path selectors 2009-06-22 10:12:27 +01:00
dm-queue-length.c dm mpath: add queue length load balancer 2009-06-22 10:12:27 +01:00
dm-raid1.c block: unify flags for struct bio and struct request 2010-08-07 18:20:39 +02:00
dm-region-hash.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
dm-round-robin.c dm mpath: add start_io and nr_bytes to path selectors 2009-06-22 10:12:27 +01:00
dm-service-time.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
dm-snap-persistent.c dm snapshot: persistent annotate work_queue as on stack 2010-02-16 18:42:51 +00:00
dm-snap-transient.c dm snapshot: move cow ref from exception store to snap core 2009-12-10 23:52:12 +00:00
dm-snap.c dm snapshot: test chunk size against both origin and snapshot 2010-08-12 04:13:51 +01:00
dm-stripe.c block: unify flags for struct bio and struct request 2010-08-07 18:20:39 +02:00
dm-sysfs.c Driver core: Constify struct sysfs_ops in struct kobj_type 2010-03-07 17:04:49 -08:00
dm-table.c dm table: remove unused dm_get_device range parameters 2010-03-06 02:32:27 +00:00
dm-target.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
dm-uevent.c dm table: remove dm_get from dm_table_get_md 2010-03-06 02:29:52 +00:00
dm-uevent.h
dm-zero.c
dm.c dm: prevent access to md being deleted 2010-08-12 04:13:54 +01:00
dm.h dm ioctl: introduce flag indicating uevent was generated 2010-03-06 02:32:31 +00:00
faulty.c Merge commit '3ff195b011d7decf501a4d55aeed312731094796' into for-linus 2010-05-22 08:31:36 +10:00
Kconfig Merge branch 'async' of macbook:git/btrfs-unstable 2010-08-09 10:36:44 +01:00
linear.c block: unify flags for struct bio and struct request 2010-08-07 18:20:39 +02:00
linear.h md/linear: use call_rcu to free obsolete 'conf' structures. 2009-06-18 08:49:42 +10:00
Makefile Merge branch 'async' of macbook:git/btrfs-unstable 2010-08-09 10:36:44 +01:00
md.c Merge branch 'for-linus' of git://neil.brown.name/md 2010-08-10 15:38:19 -07:00
md.h Merge branch 'for-linus' of git://neil.brown.name/md 2010-08-10 15:38:19 -07:00
multipath.c block: unify flags for struct bio and struct request 2010-08-07 18:20:39 +02:00
multipath.h md: remove mddev_to_conf "helper" macro 2009-06-16 16:54:21 +10:00
raid0.c block: unify flags for struct bio and struct request 2010-08-07 18:20:39 +02:00
raid0.h md: fix handling of array level takeover that re-arranges devices. 2010-06-24 13:33:24 +10:00
raid1.c block: unify flags for struct bio and struct request 2010-08-07 18:20:39 +02:00
raid1.h md/raid1: add takeover support for raid5->raid1 2009-12-14 12:51:41 +11:00
raid5.c Merge branch 'for-linus' of git://neil.brown.name/md 2010-08-10 15:38:19 -07:00
raid5.h md/raid5: export raid5 unplugging interface. 2010-07-26 12:53:10 +10:00
raid10.c Merge branch 'for-linus' of git://neil.brown.name/md 2010-08-10 15:38:19 -07:00
raid10.h md: fix handling of array level takeover that re-arranges devices. 2010-06-24 13:33:24 +10:00