• ChenXiaoSong's avatar
    configfs: fix a race in configfs_{,un}register_subsystem() · 84ec758f
    ChenXiaoSong authored
    When configfs_register_subsystem() or configfs_unregister_subsystem()
    is executing link_group() or unlink_group(),
    it is possible that two processes add or delete list concurrently.
    Some unfortunate interleavings of them can cause kernel panic.
    
    One of cases is:
    A --> B --> C --> D
    A <-- B <-- C <-- D
    
         delete list_head *B        |      delete list_head *C
    --------------------------------|-----------------------------------
    configfs_unregister_subsystem   |   configfs_unregister_subsystem
      unlink_group                  |     unlink_group
        unlink_obj                  |       unlink_obj
          list_del_init             |         list_del_init
            __list_del_entry        |           __list_del_entry
              __list_del            |             __list_del
                // next == C        |
                next->prev = prev   |
                                    |               next->prev = prev
                prev->next = next   |
                                    |                 // prev == B
                                    |                 prev->next = next
    
    Fix this by adding mutex when calling link_group() or unlink_group(),
    but parent configfs_subsystem is NULL when config_item is root.
    So I create a mutex configfs_subsystem_mutex.
    
    Fixes: 7063fbf2 ("[PATCH] configfs: User-driven configuration filesystem")
    Signed-off-by: default avatarChenXiaoSong <chenxiaosong2@huawei.com>
    Signed-off-by: default avatarLaibin Qiu <qiulaibin@huawei.com>
    Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
    84ec758f
dir.c 49.8 KB