s390/dasd fix oops

Hi Jens,

please apply the following patch that fixes an Oops in the DASD driver related to a race in a device structure update function.

Stefan Haberland (1):
s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing
pavgroup

 drivers/s390/block/dasd_alias.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

2.34.1

Fix Oops in dasd_alias_get_start_dev() function caused by the pavgroup pointer being NULL.

The pavgroup pointer is checked on the entrance of the function but without the lcu->lock being held. Therefore there is a race window between dasd_alias_get_start_dev() and _lcu_update() which sets pavgroup to NULL with the lcu->lock held.

Fix by checking the pavgroup pointer with lcu->lock held.

---
 drivers/s390/block/dasd_alias.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

index dc78a523a69f..b6b938aa6615 100644
@@ -675,12 +675,12 @@ int dasd_alias_remove_device(struct dasd_device *device)
 struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *base_device)
 {
 	struct dasd_eckd_private *alias_priv, *private = base_device->private;
-	struct alias_pav_group *group = private->pavgroup;
 	struct alias_lcu *lcu = private->lcu;
 	struct dasd_device *alias_device;
+	struct alias_pav_group *group;
 	unsigned long flags;
 
-	if (!group || !lcu)
+	if (!lcu)
 		return NULL;
 	if (lcu->pav == NO_PAV ||
 	    lcu->flags & (NEED_UAC_UPDATE | UPDATE_PENDING))

@@ -697,6 +697,11 @@ struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *base_device)
 	}
 
 	spin_lock_irqsave(&lcu->lock, flags);
+	group = private->pavgroup;
+	if (!group) {
+		spin_unlock_irqrestore(&lcu->lock, flags);
+		return NULL;
+	}
 	alias_device = group->next;
 	if (!alias_device) {
 		if (list_empty(&group->aliaslist)) {

2.34.1

Applied, thanks!

[1/1] s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup

      commit: db7ba07108a48c0f95b74fabbfd5d63e924f992d

Best regards,

Jens Axboe