diff options
author | NeilBrown <neilb@suse.com> | 2017-02-06 13:41:39 +1100 |
---|---|---|
committer | Ben Hutchings <ben@decadent.org.uk> | 2017-06-05 21:13:48 +0100 |
commit | a44059c1c1fac3c721fa0c34bd2de8b4853fd1a3 (patch) | |
tree | d299dcec239990b6692d0a9aee4c75f35c5cc1e0 | |
parent | b29f148b6616216772eef89175bebcd3d91bc4b2 (diff) |
md: ensure md devices are freed before module is unloaded.
commit 9356863c9409efc79029c01a85d015efae977e69 upstream.
Commit: cbd199837750 ("md: Fix unfortunate interaction with evms")
change mddev_put() so that it would not destroy an md device while
->ctime was non-zero.
Unfortunately, we didn't make sure to clear ->ctime when unloading
the module, so it is possible for an md device to remain after
module unload. An attempt to open such a device will trigger
an invalid memory reference in:
get_gendisk -> kobj_lookup -> exact_lock -> get_disk
when tring to access disk->fops, which was in the module that has
been removed.
So ensure we clear ->ctime in md_exit(), and explain how that is useful,
as it isn't immediately obvious when looking at the code.
Fixes: cbd199837750 ("md: Fix unfortunate interaction with evms")
Tested-by: Guoqing Jiang <gqjiang@suse.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
-rw-r--r-- | drivers/md/md.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/md/md.c b/drivers/md/md.c index 09145341f5cc..b8f9202f9e2f 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -8292,7 +8292,14 @@ static __exit void md_exit(void) remove_proc_entry("mdstat", NULL); for_each_mddev(mddev, tmp) { export_array(mddev); + mddev->ctime = 0; mddev->hold_active = 0; + /* + * for_each_mddev() will call mddev_put() at the end of each + * iteration. As the mddev is now fully clear, this will + * schedule the mddev for destruction by a workqueue, and the + * destroy_workqueue() below will wait for that to complete. + */ } destroy_workqueue(md_misc_wq); destroy_workqueue(md_wq); |