Commit 5de815a7 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Jens Axboe
Browse files

block: remove parent device reference from struct bsg_class_device 



Bsg holding a reference to the parent device may result in a crash if a
bsg file handle is closed after the parent device driver has unloaded.

Holding a reference is not really needed: the parent device must exist
between bsg_register_queue and bsg_unregister_queue.  Before the device
goes away the caller does blk_cleanup_queue so that all in-flight
requests to the device are gone and all new requests cannot pass beyond
the queue.  The queue itself is a refcounted object and it will stay
alive with a bsg file.

Based on analysis, previous patch and changelog from Anatoliy Glagolev.

Reported-by: default avatarAnatoliy Glagolev <glagolig@gmail.com>
Reviewed-by: default avatarJames E.J. Bottomley <jejb@linux.vnet.ibm.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent b7405176

block/bsg-lib.c

+2 −4
Original line number Diff line number Diff line
@@ -303,11 +303,9 @@ static void bsg_exit_rq(struct request_queue *q, struct request *req) 
 * @name: device to give bsg device

 * @job_fn: bsg job handler

 * @dd_job_size: size of LLD data needed for each job

 * @release: @dev release function

 */

struct request_queue *bsg_setup_queue(struct device *dev, const char *name,

		bsg_job_fn *job_fn, int dd_job_size,

		void (*release)(struct device *))

		bsg_job_fn *job_fn, int dd_job_size)

{

	struct request_queue *q;

	int ret;
@@ -331,7 +329,7 @@ struct request_queue *bsg_setup_queue(struct device *dev, const char *name, 
	blk_queue_softirq_done(q, bsg_softirq_done);

	blk_queue_rq_timeout(q, BLK_DEFAULT_SG_TIMEOUT);



	ret = bsg_register_queue(q, dev, name, &bsg_transport_ops, release);

	ret = bsg_register_queue(q, dev, name, &bsg_transport_ops);

	if (ret) {

		printk(KERN_ERR "%s: bsg interface failed to "

		       "initialize - register queue\n", dev->kobj.name);

block/bsg.c

+5 −34
Original line number Diff line number Diff line
@@ -649,18 +649,6 @@ static struct bsg_device *bsg_alloc_device(void) 
	return bd;

}



static void bsg_kref_release_function(struct kref *kref)

{

	struct bsg_class_device *bcd =

		container_of(kref, struct bsg_class_device, ref);

	struct device *parent = bcd->parent;



	if (bcd->release)

		bcd->release(bcd->parent);



	put_device(parent);

}



static int bsg_put_device(struct bsg_device *bd)

{

	int ret = 0, do_free;
@@ -693,7 +681,6 @@ static int bsg_put_device(struct bsg_device *bd) 


	kfree(bd);

out:

	kref_put(&q->bsg_dev.ref, bsg_kref_release_function);

	if (do_free)

		blk_put_queue(q);

	return ret;
@@ -759,8 +746,6 @@ static struct bsg_device *bsg_get_device(struct inode *inode, struct file *file) 
	 */

	mutex_lock(&bsg_mutex);

	bcd = idr_find(&bsg_minor_idr, iminor(inode));

	if (bcd)

		kref_get(&bcd->ref);

	mutex_unlock(&bsg_mutex);



	if (!bcd)
@@ -771,8 +756,6 @@ static struct bsg_device *bsg_get_device(struct inode *inode, struct file *file) 
		return bd;



	bd = bsg_add_device(inode, bcd->queue, file);

	if (IS_ERR(bd))

		kref_put(&bcd->ref, bsg_kref_release_function);



	return bd;

}
@@ -912,25 +895,17 @@ void bsg_unregister_queue(struct request_queue *q) 
		sysfs_remove_link(&q->kobj, "bsg");

	device_unregister(bcd->class_dev);

	bcd->class_dev = NULL;

	kref_put(&bcd->ref, bsg_kref_release_function);

	mutex_unlock(&bsg_mutex);

}

EXPORT_SYMBOL_GPL(bsg_unregister_queue);



int bsg_register_queue(struct request_queue *q, struct device *parent,

		const char *name, const struct bsg_ops *ops,

		void (*release)(struct device *))

		const char *name, const struct bsg_ops *ops)

{

	struct bsg_class_device *bcd;

	dev_t dev;

	int ret;

	struct device *class_dev = NULL;

	const char *devname;



	if (name)

		devname = name;

	else

		devname = dev_name(parent);



	/*

	 * we need a proper transport to send commands, not a stacked device
@@ -954,15 +929,12 @@ int bsg_register_queue(struct request_queue *q, struct device *parent, 


	bcd->minor = ret;

	bcd->queue = q;

	bcd->parent = get_device(parent);

	bcd->release = release;

	bcd->ops = ops;

	kref_init(&bcd->ref);

	dev = MKDEV(bsg_major, bcd->minor);

	class_dev = device_create(bsg_class, parent, dev, NULL, "%s", devname);

	class_dev = device_create(bsg_class, parent, dev, NULL, "%s", name);

	if (IS_ERR(class_dev)) {

		ret = PTR_ERR(class_dev);

		goto put_dev;

		goto idr_remove;

	}

	bcd->class_dev = class_dev;
@@ -977,8 +949,7 @@ int bsg_register_queue(struct request_queue *q, struct device *parent, 


unregister_class_dev:

	device_unregister(class_dev);

put_dev:

	put_device(parent);

idr_remove:

	idr_remove(&bsg_minor_idr, bcd->minor);

unlock:

	mutex_unlock(&bsg_mutex);
@@ -992,7 +963,7 @@ int bsg_scsi_register_queue(struct request_queue *q, struct device *parent) 
		return -EINVAL;

	}



	return bsg_register_queue(q, parent, NULL, &bsg_scsi_ops, NULL);

	return bsg_register_queue(q, parent, dev_name(parent), &bsg_scsi_ops);

}

EXPORT_SYMBOL_GPL(bsg_scsi_register_queue);

drivers/scsi/scsi_transport_fc.c

+3 −4
Original line number Diff line number Diff line
@@ -3780,8 +3780,7 @@ fc_bsg_hostadd(struct Scsi_Host *shost, struct fc_host_attrs *fc_host) 
	snprintf(bsg_name, sizeof(bsg_name),

		 "fc_host%d", shost->host_no);



	q = bsg_setup_queue(dev, bsg_name, fc_bsg_dispatch, i->f->dd_bsg_size,

			NULL);

	q = bsg_setup_queue(dev, bsg_name, fc_bsg_dispatch, i->f->dd_bsg_size);

	if (IS_ERR(q)) {

		dev_err(dev,

			"fc_host%d: bsg interface failed to initialize - setup queue\n",
@@ -3826,8 +3825,8 @@ fc_bsg_rportadd(struct Scsi_Host *shost, struct fc_rport *rport) 
	if (!i->f->bsg_request)

		return -ENOTSUPP;



	q = bsg_setup_queue(dev, NULL, fc_bsg_dispatch, i->f->dd_bsg_size,

			NULL);

	q = bsg_setup_queue(dev, dev_name(dev), fc_bsg_dispatch,

			i->f->dd_bsg_size);

	if (IS_ERR(q)) {

		dev_err(dev, "failed to setup bsg queue\n");

		return PTR_ERR(q);

drivers/scsi/scsi_transport_iscsi.c

+1 −1
Original line number Diff line number Diff line
@@ -1542,7 +1542,7 @@ iscsi_bsg_host_add(struct Scsi_Host *shost, struct iscsi_cls_host *ihost) 
		return -ENOTSUPP;



	snprintf(bsg_name, sizeof(bsg_name), "iscsi_host%d", shost->host_no);

	q = bsg_setup_queue(dev, bsg_name, iscsi_bsg_host_dispatch, 0, NULL);

	q = bsg_setup_queue(dev, bsg_name, iscsi_bsg_host_dispatch, 0);

	if (IS_ERR(q)) {

		shost_printk(KERN_ERR, shost, "bsg interface failed to "

			     "initialize - no request queue\n");

drivers/scsi/scsi_transport_sas.c

+6 −13
Original line number Diff line number Diff line
@@ -187,16 +187,6 @@ static int sas_smp_dispatch(struct bsg_job *job) 
	return 0;

}



static void sas_host_release(struct device *dev)

{

	struct Scsi_Host *shost = dev_to_shost(dev);

	struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);

	struct request_queue *q = sas_host->q;



	if (q)

		blk_cleanup_queue(q);

}



static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)

{

	struct request_queue *q;
@@ -208,7 +198,7 @@ static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy) 


	if (rphy) {

		q = bsg_setup_queue(&rphy->dev, dev_name(&rphy->dev),

				sas_smp_dispatch, 0, NULL);

				sas_smp_dispatch, 0);

		if (IS_ERR(q))

			return PTR_ERR(q);

		rphy->q = q;
@@ -217,7 +207,7 @@ static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy) 


		snprintf(name, sizeof(name), "sas_host%d", shost->host_no);

		q = bsg_setup_queue(&shost->shost_gendev, name,

				sas_smp_dispatch, 0, sas_host_release);

				sas_smp_dispatch, 0);

		if (IS_ERR(q))

			return PTR_ERR(q);

		to_sas_host_attrs(shost)->q = q;
@@ -260,8 +250,11 @@ static int sas_host_remove(struct transport_container *tc, struct device *dev, 
	struct Scsi_Host *shost = dev_to_shost(dev);

	struct request_queue *q = to_sas_host_attrs(shost)->q;



	if (q)

	if (q) {

		bsg_unregister_queue(q);

		blk_cleanup_queue(q);

	}



	return 0;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE