linux-kernel - Re: [PATCH] device-dax: avoid hang on error before devm_memremap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <499a3093-3781-7a8a-abd0-8b240db11dce@intel.com>
Date:   Tue, 31 Jul 2018 17:26:23 -0700
From:   Dave Jiang <dave.jiang@...el.com>
To:     Stefan Hajnoczi <stefanha@...hat.com>, linux-nvdimm@...ts.01.org
Cc:     linux-kernel@...r.kernel.org,
        Ross Zwisler <ross.zwisler@...ux.intel.com>,
        Vishal Verma <vishal.l.verma@...el.com>,
        Dan Williams <dan.j.williams@...el.com>
Subject: Re: [PATCH] device-dax: avoid hang on error before
 devm_memremap_pages()


On 7/31/2018 7:32 AM, Stefan Hajnoczi wrote:
> dax_pmem_percpu_exit() waits for dax_pmem_percpu_release() to invoke the
> dax_pmem->cmp completion.  Unfortunately this approach to cleaning up
> the percpu_ref only works after devm_memremap_pages() was successful.
>
> If devm_add_action_or_reset() or devm_memremap_pages() fails,
> dax_pmem_percpu_release() is not invoked.  Therefore
> dax_pmem_percpu_exit() hangs waiting for the completion:
>
>    rc = devm_add_action_or_reset(dev, dax_pmem_percpu_exit,
>    				&dax_pmem->ref);
>    if (rc)
>    	return rc;
>
>    dax_pmem->pgmap.ref = &dax_pmem->ref;
>    addr = devm_memremap_pages(dev, &dax_pmem->pgmap);
>
> Avoid the hang by calling percpu_ref_exit() in the error paths instead
> of going through dax_pmem_percpu_exit().
>
> Signed-off-by: Stefan Hajnoczi <stefanha@...hat.com>

Applied


> ---
> Found by code inspection.  Compile-tested only.
> ---
>   drivers/dax/pmem.c | 12 ++++++++----
>   1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
> index fd49b24fd6af..99e2aace8078 100644
> --- a/drivers/dax/pmem.c
> +++ b/drivers/dax/pmem.c
> @@ -105,15 +105,19 @@ static int dax_pmem_probe(struct device *dev)
>   	if (rc)
>   		return rc;
>   
> -	rc = devm_add_action_or_reset(dev, dax_pmem_percpu_exit,
> -							&dax_pmem->ref);
> -	if (rc)
> +	rc = devm_add_action(dev, dax_pmem_percpu_exit, &dax_pmem->ref);
> +	if (rc) {
> +		percpu_ref_exit(&dax_pmem->ref);
>   		return rc;
> +	}
>   
>   	dax_pmem->pgmap.ref = &dax_pmem->ref;
>   	addr = devm_memremap_pages(dev, &dax_pmem->pgmap);
> -	if (IS_ERR(addr))
> +	if (IS_ERR(addr)) {
> +		devm_remove_action(dev, dax_pmem_percpu_exit, &dax_pmem->ref);
> +		percpu_ref_exit(&dax_pmem->ref);
>   		return PTR_ERR(addr);
> +	}
>   
>   	rc = devm_add_action_or_reset(dev, dax_pmem_percpu_kill,
>   							&dax_pmem->ref);