summaryrefslogtreecommitdiff
path: root/drivers/md
diff options
context:
space:
mode:
authorKiyoshi Ueda <k-ueda@ct.jp.nec.com>2010-08-12 07:13:54 +0400
committerAlasdair G Kergon <agk@redhat.com>2010-08-12 07:13:54 +0400
commitabdc568b0540bec6d3e0afebac496adef1189b77 (patch)
tree1c88c8de6e90b7f9cbbc788fa9e3fb539f1d231c /drivers/md
parent856a6f1dbd8940e72755af145ebcd806408ecedd (diff)
downloadlinux-abdc568b0540bec6d3e0afebac496adef1189b77.tar.xz
dm: prevent access to md being deleted
This patch prevents access to mapped_device which is being deleted. Currently, even after a mapped_device has been removed from the hash, it could be accessed through idr_find() using minor number. That could cause a race and NULL pointer reference below: CPU0 CPU1 ------------------------------------------------------------------ dev_remove(param) down_write(_hash_lock) dm_lock_for_deletion(md) spin_lock(_minor_lock) set_bit(DMF_DELETING) spin_unlock(_minor_lock) __hash_remove(hc) up_write(_hash_lock) dev_status(param) md = find_device(param) down_read(_hash_lock) __find_device_hash_cell(param) dm_get_md(param->dev) md = dm_find_md(dev) spin_lock(_minor_lock) md = idr_find(MINOR(dev)) spin_unlock(_minor_lock) dm_put(md) free_dev(md) dm_get(md) up_read(_hash_lock) __dev_status(md, param) dm_put(md) This patch fixes such problems. Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com> Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com> Cc: stable@kernel.org Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Diffstat (limited to 'drivers/md')
-rw-r--r--drivers/md/dm.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index a3f21dc02bd8..ba6934c3e2c5 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2136,6 +2136,7 @@ static struct mapped_device *dm_find_md(dev_t dev)
md = idr_find(&_minor_idr, minor);
if (md && (md == MINOR_ALLOCED ||
(MINOR(disk_devt(dm_disk(md))) != minor) ||
+ dm_deleting_md(md) ||
test_bit(DMF_FREEING, &md->flags))) {
md = NULL;
goto out;