dm: prevent access to md being deleted

This patch prevents access to mapped_device which is being deleted.

Currently, even after a mapped_device has been removed from the hash,
it could be accessed through idr_find() using minor number.
That could cause a race and NULL pointer reference below:
  CPU0                          CPU1
  ------------------------------------------------------------------
  dev_remove(param)
    down_write(_hash_lock)
    dm_lock_for_deletion(md)
      spin_lock(_minor_lock)
      set_bit(DMF_DELETING)
      spin_unlock(_minor_lock)
    __hash_remove(hc)
    up_write(_hash_lock)
                                dev_status(param)
                                  md = find_device(param)
                                         down_read(_hash_lock)
                                         __find_device_hash_cell(param)
                                           dm_get_md(param->dev)
                                             md = dm_find_md(dev)
                                                    spin_lock(_minor_lock)
                                                    md = idr_find(MINOR(dev))
                                                    spin_unlock(_minor_lock)
    dm_put(md)
      free_dev(md)
                                             dm_get(md)
                                         up_read(_hash_lock)
                                  __dev_status(md, param)
                                  dm_put(md)

This patch fixes such problems.

Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Cc: stable@kernel.org
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index a3f21dc02bd891fb84d8df00c5b22b2ad15a2e64..ba6934c3e2c5ecf0d2dbed5d560a97327c8bf774 100644 (file)
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2136,6 +2136,7 @@ static struct mapped_device *dm_find_md(dev_t dev)
        md = idr_find(&_minor_idr, minor);
        if (md && (md == MINOR_ALLOCED ||
                   (MINOR(disk_devt(dm_disk(md))) != minor) ||
+                  dm_deleting_md(md) ||
                   test_bit(DMF_FREEING, &md->flags))) {
                md = NULL;
                goto out;