diff options
author | Mikulas Patocka <mpatocka@redhat.com> | 2015-02-17 14:30:53 -0500 |
---|---|---|
committer | Jiri Slaby <jslaby@suse.cz> | 2015-03-16 14:58:17 +0100 |
commit | 0a21fde3fe39835289f69d2280a68d570f611824 (patch) | |
tree | 9ccc75b50e675432c2a209327562badab9583f4d /drivers/virt | |
parent | d5a590350fc031273762482cc0d46a6c4a8220b3 (diff) |
dm: fix a race condition in dm_get_md
commit 2bec1f4a8832e74ebbe859f176d8a9cb20dd97f4 upstream.
The function dm_get_md finds a device mapper device with a given dev_t,
increases the reference count and returns the pointer.
dm_get_md calls dm_find_md, dm_find_md takes _minor_lock, finds the
device, tests that the device doesn't have DMF_DELETING or DMF_FREEING
flag, drops _minor_lock and returns pointer to the device. dm_get_md then
calls dm_get. dm_get calls BUG if the device has the DMF_FREEING flag,
otherwise it increments the reference count.
There is a possible race condition - after dm_find_md exits and before
dm_get is called, there are no locks held, so the device may disappear or
DMF_FREEING flag may be set, which results in BUG.
To fix this bug, we need to call dm_get while we hold _minor_lock. This
patch renames dm_find_md to dm_get_md and changes it so that it calls
dm_get while holding the lock.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'drivers/virt')
0 files changed, 0 insertions, 0 deletions