device-dax: fix cdev leak (ed01e50a) · Commits · 戴 / test

If device_add() fails, cleanup the cdev. Otherwise, we leak a kobj_map() with a stale device number. As Jason points out, there is a small possibility that userspace has opened and mapped the device in the time between cdev_add() and the device_add() failure. We need a new kill_dax_dev() helper to invalidate any established mappings. Fixes: ("dax: convert to the cdev api") Cc: <stable@vger.kernel.org> Reported-by:

Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Signed-off-by:

Dan Williams <dan.j.williams@intel.com> Signed-off-by:

Logan Gunthorpe <logang@deltatee.com> Reviewed-by:

Johannes Thumshirn <jthumshirn@suse.de> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/dax/dax.c

+11 −4

Original line number	Diff line number	Diff line
		@@ -675,13 +675,10 @@ static void dax_dev_release(struct device *dev)
		kfree(dax_dev);
		}

		static void unregister_dax_dev(void *dev)
		static void kill_dax_dev(struct dax_dev *dax_dev)
		{
		struct dax_dev *dax_dev = to_dax_dev(dev);
		struct cdev *cdev = &dax_dev->cdev;

		dev_dbg(dev, "%s\n", __func__);

		/*
		* Note, rcu is not protecting the liveness of dax_dev, rcu is
		* ensuring that any fault handlers that might have seen
		@@ -693,6 +690,15 @@ static void unregister_dax_dev(void *dev)
		synchronize_rcu();
		unmap_mapping_range(dax_dev->inode->i_mapping, 0, 0, 1);
		cdev_del(cdev);
		}

		static void unregister_dax_dev(void *dev)
		{
		struct dax_dev *dax_dev = to_dax_dev(dev);

		dev_dbg(dev, "%s\n", __func__);

		kill_dax_dev(dax_dev);
		device_unregister(dev);
		}

		@@ -769,6 +775,7 @@ struct dax_dev devm_create_dax_dev(struct dax_region dax_region,
		dev_set_name(dev, "dax%d.%d", dax_region->id, dax_dev->id);
		rc = device_add(dev);
		if (rc) {
		kill_dax_dev(dax_dev);
		put_device(dev);
		return ERR_PTR(rc);
		}

Admin message