[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20191219183225.177799954@linuxfoundation.org>
Date: Thu, 19 Dec 2019 19:34:16 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-kernel@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
stable@...r.kernel.org, Prarit Bhargava <prarit@...hat.com>,
Konstantin Khorenko <khorenko@...tuozzo.com>,
Jessica Yu <jeyu@...nel.org>, Sasha Levin <sashal@...nel.org>
Subject: [PATCH 4.9 174/199] kernel/module.c: wakeup processes in module_wq on module unload
From: Konstantin Khorenko <khorenko@...tuozzo.com>
[ Upstream commit 5d603311615f612320bb77bd2a82553ef1ced5b7 ]
Fix the race between load and unload a kernel module.
sys_delete_module()
try_stop_module()
mod->state = _GOING
add_unformed_module()
old = find_module_all()
(old->state == _GOING =>
wait_event_interruptible())
During pre-condition
finished_loading() rets 0
schedule()
(never gets waken up later)
free_module()
mod->state = _UNFORMED
list_del_rcu(&mod->list)
(dels mod from "modules" list)
return
The race above leads to modprobe hanging forever on loading
a module.
Error paths on loading module call wake_up_all(&module_wq) after
freeing module, so let's do the same on straight module unload.
Fixes: 6e6de3dee51a ("kernel/module.c: Only return -EEXIST for modules that have finished loading")
Reviewed-by: Prarit Bhargava <prarit@...hat.com>
Signed-off-by: Konstantin Khorenko <khorenko@...tuozzo.com>
Signed-off-by: Jessica Yu <jeyu@...nel.org>
Signed-off-by: Sasha Levin <sashal@...nel.org>
---
kernel/module.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/module.c b/kernel/module.c
index fb9e07aec49e0..9cb1437151ae7 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -995,6 +995,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
strlcpy(last_unloaded_module, mod->name, sizeof(last_unloaded_module));
free_module(mod);
+ /* someone could wait for the module in add_unformed_module() */
+ wake_up_all(&module_wq);
return 0;
out:
mutex_unlock(&module_mutex);
--
2.20.1
Powered by blists - more mailing lists