Skip to contentSkip to conversation

patch "device-dax: fix cdev leak" added to char-misc-testing

PATCH [email protected] 1 participant 1 message Mar 16, 2017

Subsystems (2)
Stable branch Device direct access (DAX)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

device-dax: fix cdev leak

to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open.

If you have any questions about this process, please let me know.

Quoted 1 line

From 03e61923cac2e8f6b24eeeaf8e8bd17b6ebe5b88 Mon Sep 17 00:00:00 2001

From: Dan Williams <[email protected]>
Date: Mon, 6 Mar 2017 00:04:18 -0700
Subject: device-dax: fix cdev leak

If device_add() fails, cleanup the cdev. Otherwise, we leak a kobj_map() with a stale device number.

As Jason points out, there is a small possibility that userspace has opened and mapped the device in the time between cdev_add() and the device_add() failure. We need a new kill_dax_dev() helper to invalidate any established mappings.

Fixes ba09c01d2fa8 ("dax: convert to the cdev api")
Cc <[email protected]>
Reported-by Jason Gunthorpe <[email protected]>
Signed-off-by Dan Williams <[email protected]>
Signed-off-by Logan Gunthorpe <[email protected]>
Reviewed-by Johannes Thumshirn <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/dax/dax.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/dax/dax.c +11 -4
index 8d9829ff2a78..a5ed59a5a968 100644
@@ -675,13 +675,10 @@ static void dax_dev_release(struct device *dev)
 	kfree(dax_dev);
 }
 
-static void unregister_dax_dev(void *dev)
+static void kill_dax_dev(struct dax_dev *dax_dev)
 {
-	struct dax_dev *dax_dev = to_dax_dev(dev);
 	struct cdev *cdev = &dax_dev->cdev;
 
-	dev_dbg(dev, "%s\n", __func__);
-
 	/*
 	 * Note, rcu is not protecting the liveness of dax_dev, rcu is
 	 * ensuring that any fault handlers that might have seen

@@ -693,6 +690,15 @@ static void unregister_dax_dev(void *dev)
 	synchronize_rcu();
 	unmap_mapping_range(dax_dev->inode->i_mapping, 0, 0, 1);
 	cdev_del(cdev);
+}
+
+static void unregister_dax_dev(void *dev)
+{
+	struct dax_dev *dax_dev = to_dax_dev(dev);
+
+	dev_dbg(dev, "%s\n", __func__);
+
+	kill_dax_dev(dax_dev);
 	device_unregister(dev);
 }
 

@@ -769,6 +775,7 @@ struct dax_dev *devm_create_dax_dev(struct dax_region *dax_region,
 	dev_set_name(dev, "dax%d.%d", dax_region->id, dax_dev->id);
 	rc = device_add(dev);
 	if (rc) {
+		kill_dax_dev(dax_dev);
 		put_device(dev);
 		return ERR_PTR(rc);
 	}
Signature · 1 line
2.12.0