linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-08 14:42:37 +02:00

Linux kernel source tree

Go to file

Vladis Dronov 0393b87201 ptp: fix the race between the release of ptp_clock and cdev [ Upstream commit `a33121e548` ] In a case when a ptp chardev (like /dev/ptp0) is open but an underlying device is removed, closing this file leads to a race. This reproduces easily in a kvm virtual machine: ts# cat openptp0.c int main() { ... fp = fopen("/dev/ptp0", "r"); ... sleep(10); } ts# uname -r 5.5.0-rc3-46cf053e ts# cat /proc/cmdline ... slub_debug=FZP ts# modprobe ptp_kvm ts# ./openptp0 & [1] 670 opened /dev/ptp0, sleeping 10s... ts# rmmod ptp_kvm ts# ls /dev/ptp* ls: cannot access '/dev/ptp': No such file or directory ts# ...woken up [ 48.010809] general protection fault: 0000 [#1] SMP [ 48.012502] CPU: 6 PID: 658 Comm: openptp0 Not tainted 5.5.0-rc3-46cf053e #25 [ 48.014624] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ... [ 48.016270] RIP: 0010:module_put.part.0+0x7/0x80 [ 48.017939] RSP: 0018:ffffb3850073be00 EFLAGS: 00010202 [ 48.018339] RAX: 000000006b6b6b6b RBX: 6b6b6b6b6b6b6b6b RCX: ffff89a476c00ad0 [ 48.018936] RDX: fffff65a08d3ea08 RSI: 0000000000000247 RDI: 6b6b6b6b6b6b6b6b [ 48.019470] ... ^^^ a slub poison [ 48.023854] Call Trace: [ 48.024050] __fput+0x21f/0x240 [ 48.024288] task_work_run+0x79/0x90 [ 48.024555] do_exit+0x2af/0xab0 [ 48.024799] ? vfs_write+0x16a/0x190 [ 48.025082] do_group_exit+0x35/0x90 [ 48.025387] __x64_sys_exit_group+0xf/0x10 [ 48.025737] do_syscall_64+0x3d/0x130 [ 48.026056] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 48.026479] RIP: 0033:0x7f53b12082f6 [ 48.026792] ... [ 48.030945] Modules linked in: ptp i6300esb watchdog [last unloaded: ptp_kvm] [ 48.045001] Fixing recursive fault but reboot is needed! This happens in: static void __fput(struct file file) { ... if (file->f_op->release) file->f_op->release(inode, file); <<< cdev is kfree'd here if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL && !(mode & FMODE_PATH))) { cdev_put(inode->i_cdev); <<< cdev fields are accessed here Namely: __fput() posix_clock_release() kref_put(&clk->kref, delete_clock) <<< the last reference delete_clock() delete_ptp_clock() kfree(ptp) <<< cdev is embedded in ptp cdev_put module_put(p->owner) <<< *p is kfree'd, bang! Here cdev is embedded in posix_clock which is embedded in ptp_clock. The race happens because ptp_clock's lifetime is controlled by two refcounts: kref and cdev.kobj in posix_clock. This is wrong. Make ptp_clock's sysfs device a parent of cdev with cdev_device_add() created especially for such cases. This way the parent device with its ptp_clock is not released until all references to the cdev are released. This adds a requirement that an initialized but not exposed struct device should be provided to posix_clock_register() by a caller instead of a simple dev_t. This approach was adopted from the commit `72139dfa24` ("watchdog: Fix the race between the release of watchdog_core_data and cdev"). See details of the implementation in the commit `233ed09d7f` ("chardev: add helper function to register char devs with a struct device"). Link: https://lore.kernel.org/linux-fsdevel/20191125125342.6189-1-vdronov@redhat.com/T/#u Analyzed-by: Stephen Johnston <sjohnsto@redhat.com> Analyzed-by: Vern Lovejoy <vlovejoy@redhat.com> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Acked-by: Richard Cochran <richardcochran@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-01-04 19:13:35 +01:00
arch	x86/mce: Fix possibly incorrect severity calculation on AMD	2020-01-04 19:13:19 +01:00
block	blk-mq: make sure that line break can be printed	2019-12-17 20:35:48 +01:00
certs	export.h: remove VMLINUX_SYMBOL() and VMLINUX_SYMBOL_STR()	2018-08-22 23:21:44 +09:00
crypto	crypto: user - fix memory leak in crypto_report	2019-12-13 08:52:48 +01:00
Documentation	mm, thp, proc: report THP eligibility for each vma	2019-12-17 20:35:45 +01:00
drivers	ptp: fix the race between the release of ptp_clock and cdev	2020-01-04 19:13:35 +01:00
firmware	kbuild: remove all dummy assignments to obj-	2017-11-18 11:46:06 +09:00
fs	filldir[64]: remove WARN_ON_ONCE() for bad directory entries	2020-01-04 19:13:26 +01:00
include	ptp: fix the race between the release of ptp_clock and cdev	2020-01-04 19:13:35 +01:00
init	fork: fix some -Wmissing-prototypes warnings	2019-12-05 09:21:04 +01:00
ipc	ipc/mqueue.c: only perform resource calculation if user valid	2019-08-06 19:06:52 +02:00
kernel	ptp: fix the race between the release of ptp_clock and cdev	2020-01-04 19:13:35 +01:00
lib	idr: Fix idr_get_next_ul race with idr_remove	2019-12-17 20:36:02 +01:00
LICENSES	LICENSES: Remove CC-BY-SA-4.0 license text	2018-10-18 11:28:50 +02:00
mm	mm, thp, proc: report THP eligibility for each vma	2019-12-17 20:35:45 +01:00
net	net: icmp: fix data-race in cmp_global_allow()	2020-01-04 19:13:30 +01:00
samples	samples: pktgen: fix proc_cmd command result check logic	2019-12-31 16:34:59 +01:00
scripts	scripts/kallsyms: fix definitely-lost memory leak	2020-01-04 19:13:09 +01:00
security	apparmor: fix unsigned len comparison with less than zero	2020-01-04 19:13:08 +01:00
sound	ALSA: hda - Downgrade error message for single-cmd fallback	2020-01-04 19:13:22 +01:00
tools	perf strbuf: Remove redundant va_end() in strbuf_addv()	2020-01-04 19:13:24 +01:00
usr	kbuild: clean compressed initramfs image	2019-10-07 18:57:16 +02:00
virt	KVM: arm/arm64: vgic: Don't rely on the wrong pending table	2019-12-13 08:52:45 +01:00
.clang-format	clang-format: Set IndentWrappedFunctionNames false	2018-08-01 18:38:51 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes	.gitattributes: set git diff driver for C source code files	2016-10-07 18:46:30 -07:00
.gitignore	Kbuild updates for v4.17 (2nd)	2018-04-15 17:21:30 -07:00
.mailmap	libnvdimm-for-4.19_misc	2018-08-25 18:13:10 -07:00
COPYING	COPYING: use the new text with points to the license files	2018-03-23 12:41:45 -06:00
CREDITS	9p: remove Ron Minnich from MAINTAINERS	2018-08-17 16:20:26 -07:00
Kbuild	Kbuild updates for v4.15	2017-11-17 17:45:29 -08:00
Kconfig	kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt	2018-08-02 08:06:55 +09:00
MAINTAINERS	USB: rio500: Remove Rio 500 kernel driver	2019-10-17 13:44:47 -07:00
Makefile	Linux 4.19.92	2019-12-31 16:36:37 +01:00
README	Docs: Added a pointer to the formatted docs to README	2018-03-21 09:02:53 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.