md: fix use-after-free bug when dropping an rdev from an md array
Due to possible deadlock issues we need to use a schedule work to kobject_del an 'rdev' object from a different thread. A recent change means that kobject_add no longer gets a refernce, and kobject_del doesn't put a reference. Consequently, we need to explicitly hold a reference to ensure that the last reference isn't dropped before the scheduled work get a chance to call kobject_del. Also, rename delayed_delete to md_delayed_delete to that it is more obvious in a stack trace which code is to blame. Cc: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
a17184a911
commit
177a99b23e
|
@ -1419,10 +1419,11 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
|
|||
return err;
|
||||
}
|
||||
|
||||
static void delayed_delete(struct work_struct *ws)
|
||||
static void md_delayed_delete(struct work_struct *ws)
|
||||
{
|
||||
mdk_rdev_t *rdev = container_of(ws, mdk_rdev_t, del_work);
|
||||
kobject_del(&rdev->kobj);
|
||||
kobject_put(&rdev->kobj);
|
||||
}
|
||||
|
||||
static void unbind_rdev_from_array(mdk_rdev_t * rdev)
|
||||
|
@ -1441,7 +1442,8 @@ static void unbind_rdev_from_array(mdk_rdev_t * rdev)
|
|||
/* We need to delay this, otherwise we can deadlock when
|
||||
* writing to 'remove' to "dev/state"
|
||||
*/
|
||||
INIT_WORK(&rdev->del_work, delayed_delete);
|
||||
INIT_WORK(&rdev->del_work, md_delayed_delete);
|
||||
kobject_get(&rdev->kobj);
|
||||
schedule_work(&rdev->del_work);
|
||||
}
|
||||
|
||||
|
@ -3686,7 +3688,7 @@ static int do_md_stop(mddev_t * mddev, int mode)
|
|||
sysfs_remove_link(&mddev->kobj, nm);
|
||||
}
|
||||
|
||||
/* make sure all delayed_delete calls have finished */
|
||||
/* make sure all md_delayed_delete calls have finished */
|
||||
flush_scheduled_work();
|
||||
|
||||
export_array(mddev);
|
||||
|
|
Loading…
Reference in a new issue