Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-13 14:43:03 +00:00
Code Issues Packages Projects Releases Wiki Activity
77d3d7c1d5
linux/drivers/base
History
Tejun Heo 77d3d7c1d5 driver-core: fix race condition in get_device_parent() 
sysfs is creating several devices in cuse class concurrently and with
CONFIG_SYSFS_DEPRECATED turned off, it triggers the following oops.

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
 IP: [<ffffffff81158b0a>] sysfs_addrm_start+0x4a/0xf0
 PGD 75bb067 PUD 75be067 PMD 0
 Oops: 0000 [#1] PREEMPT SMP
 last sysfs file: /sys/devices/system/cpu/cpu7/topology/core_siblings
 CPU 1
 Modules linked in: cuse fuse
 Pid: 4737, comm: osspd Not tainted 2.6.31-work #77
 RIP: 0010:[<ffffffff81158b0a>]  [<ffffffff81158b0a>] sysfs_addrm_start+0x4a/0xf0
 RSP: 0018:ffff88000042f8f8  EFLAGS: 00010296
 RAX: ffff88000042ffd8 RBX: 0000000000000000 RCX: 0000000000000000
 RDX: 0000000000000000 RSI: ffff880007eef660 RDI: 0000000000000001
 RBP: ffff88000042f918 R08: 0000000000000000 R09: 0000000000000000
 R10: 0000000000000001 R11: ffffffff81158b0a R12: ffff88000042f928
 R13: 00000000fffffff4 R14: 0000000000000000 R15: ffff88000042f9a0
 FS:  00007fe93905a950(0000) GS:ffff880008600000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 0000000000000038 CR3: 00000000077c9000 CR4: 00000000000006e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
 Process osspd (pid: 4737, threadinfo ffff88000042e000, task ffff880007eef040)
 Stack:
  ffff880005da10e8 0000000011cc8d6e ffff88000042f928 ffff880003d28a28
 <0> ffff88000042f988 ffffffff811592d7 0000000000000000 0000000000000000
 <0> 0000000000000000 0000000000000000 ffff88000042f958 0000000011cc8d6e
 Call Trace:
  [<ffffffff811592d7>] create_dir+0x67/0xe0
  [<ffffffff811593a8>] sysfs_create_dir+0x58/0xb0
  [<ffffffff8128ca7c>] ? kobject_add_internal+0xcc/0x220
  [<ffffffff812942e1>] ? vsnprintf+0x3c1/0xb90
  [<ffffffff8128cab7>] kobject_add_internal+0x107/0x220
  [<ffffffff8128cd37>] kobject_add_varg+0x47/0x80
  [<ffffffff8128ce53>] kobject_add+0x53/0x90
  [<ffffffff81357d84>] device_add+0xd4/0x690
  [<ffffffff81356c2b>] ? dev_set_name+0x4b/0x70
  [<ffffffffa001a884>] cuse_process_init_reply+0x2b4/0x420 [cuse]
  ...

The problem is that kobject_add_internal() first adds a kobject to the
kset and then try to create sysfs directory for it.  If the creation
fails, it remove the kobject from the kset.  get_device_parent()
accesses class_dirs kset while only holding class_dirs.list_lock to
see whether the cuse class dir exists.  But when it exists, it may not
have finished initialization yet or may fail and get removed soon.  In
the above case, the former happened so the second one ends up trying
to create subdirectory under NULL sysfs_dirent.

Fix it by grabbing a mutex in get_device_parent().

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Colin Guthrie <cguthrie@mandriva.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-03-07 17:04:46 -08:00
..
power PM: Provide generic subsystem-level callbacks 2010-03-06 21:28:37 +01:00
attribute_container.c driver core: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:31 -08:00
base.h Driver Core: devtmpfs - kernel-maintained tmpfs-based /dev 2009-09-15 09:50:49 -07:00
bus.c driver core: Prevent reference to freed memory on error path 2009-12-23 11:23:44 -08:00
class.c class: Free the class private data in class_release 2010-02-16 15:43:00 -08:00
core.c driver-core: fix race condition in get_device_parent() 2010-03-07 17:04:46 -08:00
cpu.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu 2009-12-14 09:58:24 -08:00
dd.c tree-wide: fix assorted typos all over the place 2009-12-04 15:39:55 +01:00
devres.c devres: WARN() and return, don't crash on device_del() of uninitialized device 2009-07-12 13:02:09 -07:00
devtmpfs.c driver-core: fix devtmpfs crash on s390 2010-01-20 15:02:05 -08:00
dma-coherent.c driver-core: move dma-coherent.c from kernel to driver/base 2009-09-15 09:50:47 -07:00
dma-mapping.c devres: device resource management 2007-02-09 17:39:36 -05:00
driver.c Driver core: driver_attribute parameters can often be const* 2009-12-23 11:23:43 -08:00
firmware_class.c firmware_class: make request_firmware_nowait more useful 2009-12-11 11:24:52 -08:00
firmware.c firmware: change firmware_kset to firmware_kobj 2008-01-24 20:40:23 -08:00
hypervisor.c kobject: convert /sys/hypervisor to use kobject_create 2008-01-24 20:40:15 -08:00
init.c Driver Core: devtmpfs - kernel-maintained tmpfs-based /dev 2009-09-15 09:50:49 -07:00
iommu.c drivers/base/iommu.c: add missing includes 2009-05-06 16:36:10 -07:00
isa.c dma-mapping: replace all DMA_24BIT_MASK macro with DMA_BIT_MASK(24) 2009-04-07 08:31:12 -07:00
Kconfig Driver Core: devtmpfs - kernel-maintained tmpfs-based /dev 2009-09-15 09:50:49 -07:00
Makefile Driver Core: devtmpfs - kernel-maintained tmpfs-based /dev 2009-09-15 09:50:49 -07:00
map.c [PATCH] kobj_map semaphore to mutex conversion 2006-03-20 13:42:58 -08:00
memory.c Revert "sysdev: fix prototype for memory_sysdev_class show/store functions" 2010-01-20 15:02:13 -08:00
module.c Driver core: move the static kobject out of struct driver 2008-01-24 20:40:35 -08:00
node.c mm: slab-allocate memory section nodemask for large systems 2009-12-15 08:53:20 -08:00
platform.c Driver core: export platform_device_register_data as a GPL symbol 2009-12-23 11:23:44 -08:00
sys.c driver core: sysdev: do not send KOBJ_ADD uevent if kobject_init_and_add fails 2009-07-28 13:45:22 -07:00
topology.c cpumask: Use topology_core_cpumask()/topology_thread_cpumask() 2009-01-11 19:12:49 +01:00
transport_class.c SCSI: convert struct class_device to struct device 2008-04-19 19:10:33 -07:00