korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-11 12:28:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

block: remove parent device reference from struct bsg_class_device

Browse Source 
Bsg holding a reference to the parent device may result in a crash if a
bsg file handle is closed after the parent device driver has unloaded.

Holding a reference is not really needed: the parent device must exist
between bsg_register_queue and bsg_unregister_queue.  Before the device
goes away the caller does blk_cleanup_queue so that all in-flight
requests to the device are gone and all new requests cannot pass beyond
the queue.  The queue itself is a refcounted object and it will stay
alive with a bsg file.

Based on analysis, previous patch and changelog from Anatoliy Glagolev.

Reported-by: Anatoliy Glagolev <glagolig@gmail.com>
Reviewed-by: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Christoph Hellwig 2018-05-29 08:40:23 +02:00 committed by Jens Axboe
parent b7405176b5
commit 5de815a7ee
7 changed files with 19 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
block/bsg-lib.c
View File

@ -303,11 +303,9 @@ static void bsg_exit_rq(struct request_queue *q, struct request *req)
* @name: device to give bsg device * @name: device to give bsg device
* @job_fn: bsg job handler * @job_fn: bsg job handler
* @dd_job_size: size of LLD data needed for each job * @dd_job_size: size of LLD data needed for each job
* @release: @dev release function
*/ */
struct request_queue *bsg_setup_queue(struct device *dev, const char *name, struct request_queue *bsg_setup_queue(struct device *dev, const char *name,
bsg_job_fn *job_fn, int dd_job_size, bsg_job_fn *job_fn, int dd_job_size)
void (*release)(struct device *))
{ {
struct request_queue *q; struct request_queue *q;
int ret; int ret;
@ -331,7 +329,7 @@ struct request_queue *bsg_setup_queue(struct device *dev, const char *name,
blk_queue_softirq_done(q, bsg_softirq_done); blk_queue_softirq_done(q, bsg_softirq_done);
blk_queue_rq_timeout(q, BLK_DEFAULT_SG_TIMEOUT); blk_queue_rq_timeout(q, BLK_DEFAULT_SG_TIMEOUT);
ret = bsg_register_queue(q, dev, name, &bsg_transport_ops, release); ret = bsg_register_queue(q, dev, name, &bsg_transport_ops);
if (ret) { if (ret) {
printk(KERN_ERR "%s: bsg interface failed to " printk(KERN_ERR "%s: bsg interface failed to "
"initialize - register queue\n", dev->kobj.name); "initialize - register queue\n", dev->kobj.name);

39
block/bsg.c
View File

@ -649,18 +649,6 @@ static struct bsg_device *bsg_alloc_device(void)
return bd; return bd;
} }
static void bsg_kref_release_function(struct kref *kref)
{
struct bsg_class_device *bcd =
container_of(kref, struct bsg_class_device, ref);
struct device *parent = bcd->parent;
if (bcd->release)
bcd->release(bcd->parent);
put_device(parent);
}
static int bsg_put_device(struct bsg_device *bd) static int bsg_put_device(struct bsg_device *bd)
{ {
int ret = 0, do_free; int ret = 0, do_free;
@ -693,7 +681,6 @@ static int bsg_put_device(struct bsg_device *bd)
kfree(bd); kfree(bd);
out: out:
kref_put(&q->bsg_dev.ref, bsg_kref_release_function);
if (do_free) if (do_free)
blk_put_queue(q); blk_put_queue(q);
return ret; return ret;
@ -759,8 +746,6 @@ static struct bsg_device *bsg_get_device(struct inode *inode, struct file *file)
*/ */
mutex_lock(&bsg_mutex); mutex_lock(&bsg_mutex);
bcd = idr_find(&bsg_minor_idr, iminor(inode)); bcd = idr_find(&bsg_minor_idr, iminor(inode));
if (bcd)
kref_get(&bcd->ref);
mutex_unlock(&bsg_mutex); mutex_unlock(&bsg_mutex);
if (!bcd) if (!bcd)
@ -771,8 +756,6 @@ static struct bsg_device *bsg_get_device(struct inode *inode, struct file *file)
return bd; return bd;
bd = bsg_add_device(inode, bcd->queue, file); bd = bsg_add_device(inode, bcd->queue, file);
if (IS_ERR(bd))
kref_put(&bcd->ref, bsg_kref_release_function);
return bd; return bd;
} }
@ -912,25 +895,17 @@ void bsg_unregister_queue(struct request_queue *q)
sysfs_remove_link(&q->kobj, "bsg"); sysfs_remove_link(&q->kobj, "bsg");
device_unregister(bcd->class_dev); device_unregister(bcd->class_dev);
bcd->class_dev = NULL; bcd->class_dev = NULL;
kref_put(&bcd->ref, bsg_kref_release_function);
mutex_unlock(&bsg_mutex); mutex_unlock(&bsg_mutex);
} }
EXPORT_SYMBOL_GPL(bsg_unregister_queue); EXPORT_SYMBOL_GPL(bsg_unregister_queue);
int bsg_register_queue(struct request_queue *q, struct device *parent, int bsg_register_queue(struct request_queue *q, struct device *parent,
const char *name, const struct bsg_ops *ops, const char *name, const struct bsg_ops *ops)
void (*release)(struct device *))
{ {
struct bsg_class_device *bcd; struct bsg_class_device *bcd;
dev_t dev; dev_t dev;
int ret; int ret;
struct device *class_dev = NULL; struct device *class_dev = NULL;
const char *devname;
if (name)
devname = name;
else
devname = dev_name(parent);
/* /*
* we need a proper transport to send commands, not a stacked device * we need a proper transport to send commands, not a stacked device
@ -954,15 +929,12 @@ int bsg_register_queue(struct request_queue *q, struct device *parent,
bcd->minor = ret; bcd->minor = ret;
bcd->queue = q; bcd->queue = q;
bcd->parent = get_device(parent);
bcd->release = release;
bcd->ops = ops; bcd->ops = ops;
kref_init(&bcd->ref);
dev = MKDEV(bsg_major, bcd->minor); dev = MKDEV(bsg_major, bcd->minor);
class_dev = device_create(bsg_class, parent, dev, NULL, "%s", devname); class_dev = device_create(bsg_class, parent, dev, NULL, "%s", name);
if (IS_ERR(class_dev)) { if (IS_ERR(class_dev)) {
ret = PTR_ERR(class_dev); ret = PTR_ERR(class_dev);
goto put_dev; goto idr_remove;
} }
bcd->class_dev = class_dev; bcd->class_dev = class_dev;
@ -977,8 +949,7 @@ int bsg_register_queue(struct request_queue *q, struct device *parent,
unregister_class_dev: unregister_class_dev:
device_unregister(class_dev); device_unregister(class_dev);
put_dev: idr_remove:
put_device(parent);
idr_remove(&bsg_minor_idr, bcd->minor); idr_remove(&bsg_minor_idr, bcd->minor);
unlock: unlock:
mutex_unlock(&bsg_mutex); mutex_unlock(&bsg_mutex);
@ -992,7 +963,7 @@ int bsg_scsi_register_queue(struct request_queue *q, struct device *parent)
return -EINVAL; return -EINVAL;
} }
return bsg_register_queue(q, parent, NULL, &bsg_scsi_ops, NULL); return bsg_register_queue(q, parent, dev_name(parent), &bsg_scsi_ops);
} }
EXPORT_SYMBOL_GPL(bsg_scsi_register_queue); EXPORT_SYMBOL_GPL(bsg_scsi_register_queue);

7
drivers/scsi/scsi_transport_fc.c
View File

@ -3780,8 +3780,7 @@ fc_bsg_hostadd(struct Scsi_Host *shost, struct fc_host_attrs *fc_host)
snprintf(bsg_name, sizeof(bsg_name), snprintf(bsg_name, sizeof(bsg_name),
"fc_host%d", shost->host_no); "fc_host%d", shost->host_no);
q = bsg_setup_queue(dev, bsg_name, fc_bsg_dispatch, i->f->dd_bsg_size, q = bsg_setup_queue(dev, bsg_name, fc_bsg_dispatch, i->f->dd_bsg_size);
NULL);
if (IS_ERR(q)) { if (IS_ERR(q)) {
dev_err(dev, dev_err(dev,
"fc_host%d: bsg interface failed to initialize - setup queue\n", "fc_host%d: bsg interface failed to initialize - setup queue\n",
@ -3826,8 +3825,8 @@ fc_bsg_rportadd(struct Scsi_Host *shost, struct fc_rport *rport)
if (!i->f->bsg_request) if (!i->f->bsg_request)
return -ENOTSUPP; return -ENOTSUPP;
q = bsg_setup_queue(dev, NULL, fc_bsg_dispatch, i->f->dd_bsg_size, q = bsg_setup_queue(dev, dev_name(dev), fc_bsg_dispatch,
NULL); i->f->dd_bsg_size);
if (IS_ERR(q)) { if (IS_ERR(q)) {
dev_err(dev, "failed to setup bsg queue\n"); dev_err(dev, "failed to setup bsg queue\n");
return PTR_ERR(q); return PTR_ERR(q);

2
drivers/scsi/scsi_transport_iscsi.c
View File

@ -1542,7 +1542,7 @@ iscsi_bsg_host_add(struct Scsi_Host *shost, struct iscsi_cls_host *ihost)
return -ENOTSUPP; return -ENOTSUPP;
snprintf(bsg_name, sizeof(bsg_name), "iscsi_host%d", shost->host_no); snprintf(bsg_name, sizeof(bsg_name), "iscsi_host%d", shost->host_no);
q = bsg_setup_queue(dev, bsg_name, iscsi_bsg_host_dispatch, 0, NULL); q = bsg_setup_queue(dev, bsg_name, iscsi_bsg_host_dispatch, 0);
if (IS_ERR(q)) { if (IS_ERR(q)) {
shost_printk(KERN_ERR, shost, "bsg interface failed to " shost_printk(KERN_ERR, shost, "bsg interface failed to "
"initialize - no request queue\n"); "initialize - no request queue\n");

19
drivers/scsi/scsi_transport_sas.c
View File

@ -187,16 +187,6 @@ static int sas_smp_dispatch(struct bsg_job *job)
return 0; return 0;
} }
static void sas_host_release(struct device *dev)
{
struct Scsi_Host *shost = dev_to_shost(dev);
struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
struct request_queue *q = sas_host->q;
if (q)
blk_cleanup_queue(q);
}
static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy) static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)
{ {
struct request_queue *q; struct request_queue *q;
@ -208,7 +198,7 @@ static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)
if (rphy) { if (rphy) {
q = bsg_setup_queue(&rphy->dev, dev_name(&rphy->dev), q = bsg_setup_queue(&rphy->dev, dev_name(&rphy->dev),
sas_smp_dispatch, 0, NULL); sas_smp_dispatch, 0);
if (IS_ERR(q)) if (IS_ERR(q))
return PTR_ERR(q); return PTR_ERR(q);
rphy->q = q; rphy->q = q;
@ -217,7 +207,7 @@ static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)
snprintf(name, sizeof(name), "sas_host%d", shost->host_no); snprintf(name, sizeof(name), "sas_host%d", shost->host_no);
q = bsg_setup_queue(&shost->shost_gendev, name, q = bsg_setup_queue(&shost->shost_gendev, name,
sas_smp_dispatch, 0, sas_host_release); sas_smp_dispatch, 0);
if (IS_ERR(q)) if (IS_ERR(q))
return PTR_ERR(q); return PTR_ERR(q);
to_sas_host_attrs(shost)->q = q; to_sas_host_attrs(shost)->q = q;
@ -260,8 +250,11 @@ static int sas_host_remove(struct transport_container *tc, struct device *dev,
struct Scsi_Host *shost = dev_to_shost(dev); struct Scsi_Host *shost = dev_to_shost(dev);
struct request_queue *q = to_sas_host_attrs(shost)->q; struct request_queue *q = to_sas_host_attrs(shost)->q;
if (q) if (q) {
bsg_unregister_queue(q); bsg_unregister_queue(q);
blk_cleanup_queue(q);
}
return 0; return 0;
} }

3
include/linux/bsg-lib.h
View File

@ -72,8 +72,7 @@ struct bsg_job {
void bsg_job_done(struct bsg_job *job, int result, void bsg_job_done(struct bsg_job *job, int result,
unsigned int reply_payload_rcv_len); unsigned int reply_payload_rcv_len);
struct request_queue *bsg_setup_queue(struct device *dev, const char *name, struct request_queue *bsg_setup_queue(struct device *dev, const char *name,
bsg_job_fn *job_fn, int dd_job_size, bsg_job_fn *job_fn, int dd_job_size);
void (*release)(struct device *));
void bsg_job_put(struct bsg_job *job); void bsg_job_put(struct bsg_job *job);
int __must_check bsg_job_get(struct bsg_job *job); int __must_check bsg_job_get(struct bsg_job *job);

6
include/linux/bsg.h
View File

@ -17,17 +17,13 @@ struct bsg_ops {
struct bsg_class_device { struct bsg_class_device {
struct device *class_dev; struct device *class_dev;
struct device *parent;
int minor; int minor;
struct request_queue *queue; struct request_queue *queue;
struct kref ref;
const struct bsg_ops *ops; const struct bsg_ops *ops;
void (*release)(struct device *);
}; };
int bsg_register_queue(struct request_queue *q, struct device *parent, int bsg_register_queue(struct request_queue *q, struct device *parent,
const char *name, const struct bsg_ops *ops, const char *name, const struct bsg_ops *ops);
void (*release)(struct device *));
int bsg_scsi_register_queue(struct request_queue *q, struct device *parent); int bsg_scsi_register_queue(struct request_queue *q, struct device *parent);
void bsg_unregister_queue(struct request_queue *q); void bsg_unregister_queue(struct request_queue *q);
#else #else