lkml.org 
[lkml]   [2020]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 033/118] rbd: call rbd_dev_unprobe() after unwatching and flushing notifies
    Date
    From: Ilya Dryomov <idryomov@gmail.com>

    [ Upstream commit 952c48b0ed18919bff7528501e9a3fff8a24f8cd ]

    rbd_dev_unprobe() is supposed to undo most of rbd_dev_image_probe(),
    including rbd_dev_header_info(), which means that rbd_dev_header_info()
    isn't supposed to be called after rbd_dev_unprobe().

    However, rbd_dev_image_release() calls rbd_dev_unprobe() before
    rbd_unregister_watch(). This is racy because a header update notify
    can sneak in:

    "rbd unmap" thread ceph-watch-notify worker

    rbd_dev_image_release()
    rbd_dev_unprobe()
    free and zero out header
    rbd_watch_cb()
    rbd_dev_refresh()
    rbd_dev_header_info()
    read in header

    The same goes for "rbd map" because rbd_dev_image_probe() calls
    rbd_dev_unprobe() on errors. In both cases this results in a memory
    leak.

    Fixes: fd22aef8b47c ("rbd: move rbd_unregister_watch() call into rbd_dev_image_release()")
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Reviewed-by: Jason Dillaman <dillaman@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/block/rbd.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
    index bab9c546ba334..274beda31c356 100644
    --- a/drivers/block/rbd.c
    +++ b/drivers/block/rbd.c
    @@ -6933,9 +6933,10 @@ static int rbd_dev_header_name(struct rbd_device *rbd_dev)

    static void rbd_dev_image_release(struct rbd_device *rbd_dev)
    {
    - rbd_dev_unprobe(rbd_dev);
    if (rbd_dev->opts)
    rbd_unregister_watch(rbd_dev);
    +
    + rbd_dev_unprobe(rbd_dev);
    rbd_dev->image_format = 0;
    kfree(rbd_dev->spec->image_id);
    rbd_dev->spec->image_id = NULL;
    @@ -6986,7 +6987,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)

    ret = rbd_dev_header_info(rbd_dev);
    if (ret)
    - goto err_out_watch;
    + goto err_out_probe;

    /*
    * If this image is the one being mapped, we have pool name and
    @@ -7035,12 +7036,11 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)
    return 0;

    err_out_probe:
    - rbd_dev_unprobe(rbd_dev);
    -err_out_watch:
    if (!depth)
    up_write(&rbd_dev->header_rwsem);
    if (!depth)
    rbd_unregister_watch(rbd_dev);
    + rbd_dev_unprobe(rbd_dev);
    err_out_format:
    rbd_dev->image_format = 0;
    kfree(rbd_dev->spec->image_id);
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-04-22 12:18    [W:5.074 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site