Commit ed01e50a authored by Dan Williams's avatar Dan Williams Committed by Greg Kroah-Hartman

device-dax: fix cdev leak

If device_add() fails, cleanup the cdev. Otherwise, we leak a kobj_map()
with a stale device number.

As Jason points out, there is a small possibility that userspace has
opened and mapped the device in the time between cdev_add() and the
device_add() failure. We need a new kill_dax_dev() helper to invalidate
any established mappings.

Fixes: ba09c01d ("dax: convert to the cdev api")
Cc: <stable@vger.kernel.org>
Reported-by: default avatarJason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
Signed-off-by: default avatarLogan Gunthorpe <logang@deltatee.com>
Reviewed-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 233ed09d
...@@ -675,13 +675,10 @@ static void dax_dev_release(struct device *dev) ...@@ -675,13 +675,10 @@ static void dax_dev_release(struct device *dev)
kfree(dax_dev); kfree(dax_dev);
} }
static void unregister_dax_dev(void *dev) static void kill_dax_dev(struct dax_dev *dax_dev)
{ {
struct dax_dev *dax_dev = to_dax_dev(dev);
struct cdev *cdev = &dax_dev->cdev; struct cdev *cdev = &dax_dev->cdev;
dev_dbg(dev, "%s\n", __func__);
/* /*
* Note, rcu is not protecting the liveness of dax_dev, rcu is * Note, rcu is not protecting the liveness of dax_dev, rcu is
* ensuring that any fault handlers that might have seen * ensuring that any fault handlers that might have seen
...@@ -693,6 +690,15 @@ static void unregister_dax_dev(void *dev) ...@@ -693,6 +690,15 @@ static void unregister_dax_dev(void *dev)
synchronize_rcu(); synchronize_rcu();
unmap_mapping_range(dax_dev->inode->i_mapping, 0, 0, 1); unmap_mapping_range(dax_dev->inode->i_mapping, 0, 0, 1);
cdev_del(cdev); cdev_del(cdev);
}
static void unregister_dax_dev(void *dev)
{
struct dax_dev *dax_dev = to_dax_dev(dev);
dev_dbg(dev, "%s\n", __func__);
kill_dax_dev(dax_dev);
device_unregister(dev); device_unregister(dev);
} }
...@@ -769,6 +775,7 @@ struct dax_dev *devm_create_dax_dev(struct dax_region *dax_region, ...@@ -769,6 +775,7 @@ struct dax_dev *devm_create_dax_dev(struct dax_region *dax_region,
dev_set_name(dev, "dax%d.%d", dax_region->id, dax_dev->id); dev_set_name(dev, "dax%d.%d", dax_region->id, dax_dev->id);
rc = device_add(dev); rc = device_add(dev);
if (rc) { if (rc) {
kill_dax_dev(dax_dev);
put_device(dev); put_device(dev);
return ERR_PTR(rc); return ERR_PTR(rc);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment