Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1719593

[PATCH 08/17] drbd: fix potential get_ldev/put_ldev refcount imbalance during attach

Show all headers | View raw

From: Lars Ellenberg <lars.ellenberg@linbit.com>

Race:

drbd_adm_attach()               | async drbd_md_endio()
                                |
device->ldev is still NULL.     |
                                |
drbd_md_read(                   |
 .endio = drbd_md_endio;        |
 submit;                        |
 ....                           |
 wait for done == 1;            |       done = 1;
);                              |       wake_up();
.. lot of other stuff,          |
.. includeing taking and        |
...giving up locks,             |
.. doing further IO,            |
.. stuff that takes "some time" |
                                | while in this context,
                                | this is the next statement.
                                | which means this context was scheduled
.. only then, finally,          | away for "some time".
device->ldev = nbc;             |
                                |       if (device->ldev)
                                |               put_ldev()

Unlikely, but possible. I was able to provoke it "reliably"
by adding an mdelay(500); after the wake_up().
Fixed by moving the if (!NULL) put_ldev() before done = 1;

Impact of the bug was that the resulting refcount imbalance
could lead to premature destruction of the object, potentially
causing a NULL pointer dereference during a subsequent detach.

Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>

diff --git a/drivers/block/drbd/drbd_worker.c b/drivers/block/drbd/drbd_worker.c
index e48012d..f0717a9 100644
--- a/drivers/block/drbd/drbd_worker.c
+++ b/drivers/block/drbd/drbd_worker.c
@@ -65,6 +65,11 @@ void drbd_md_endio(struct bio *bio)
 	device = bio->bi_private;
 	device->md_io.error = blk_status_to_errno(bio->bi_status);
 
+	/* special case: drbd_md_read() during drbd_adm_attach() */
+	if (device->ldev)
+		put_ldev(device);
+	bio_put(bio);
+
 	/* We grabbed an extra reference in _drbd_md_sync_page_io() to be able
 	 * to timeout on the lower level device, and eventually detach from it.
 	 * If this io completion runs after that timeout expired, this
@@ -79,9 +84,6 @@ void drbd_md_endio(struct bio *bio)
 	drbd_md_put_buffer(device);
 	device->md_io.done = 1;
 	wake_up(&device->misc_wait);
-	bio_put(bio);
-	if (device->ldev) /* special case: drbd_md_read() during drbd_adm_attach() */
-		put_ldev(device);
 }
 
 /* reads on behalf of the partner,
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 00/17] DRBD updates Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 12/17] drbd: fix potential deadlock when trying to detach during handshake Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 04/17] drbd: Send P_NEG_ACK upon write error in protocol != C Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 03/17] drbd: add explicit plugging when submitting batches Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 05/17] drbd: mark symbols static where possible Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 02/17] drbd: change list_for_each_safe to while(list_first_entry_or_null) Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 01/17] drbd: introduce drbd_recv_header_maybe_unplug Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
    Re: [PATCH 01/17] drbd: introduce drbd_recv_header_maybe_unplug Jens Axboe <axboe@kernel.dk> - 2017-08-25 19:30 +0200
      Re: [PATCH 01/17] drbd: introduce drbd_recv_header_maybe_unplug Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-28 15:40 +0200
        [PATCH 01/17] drbd: introduce drbd_recv_header_maybe_unplug Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-28 16:00 +0200
  [PATCH 08/17] drbd: fix potential get_ldev/put_ldev refcount imbalance during attach Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 17/17] drbd: switch from kmalloc() to kmalloc_array() Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 07/17] drbd: new disk-option disable-write-same Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 15/17] drbd: move global variables to drbd namespace and make some static Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 16/17] drbd: abort drbd_start_resync if there is no connection Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 13/17] drbd: fix race between handshake and admin disconnect/down Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200
  [PATCH 10/17] drbd: fix rmmod cleanup, remove _all_ debugfs entries Philipp Reisner <philipp.reisner@linbit.com> - 2017-08-24 23:30 +0200

csiph-web