Commit b5ddcffa authored by Anand Jain's avatar Anand Jain Committed by David Sterba

btrfs: fix put of uninitialized kobject after seed device delete

The following test case leads to NULL kobject free error:

  mount seed /mnt
  add sprout to /mnt
  umount /mnt
  mount sprout to /mnt
  delete seed

  kobject: '(null)' (00000000dd2b87e4): is not initialized, yet kobject_put() is being called.
  WARNING: CPU: 1 PID: 15784 at lib/kobject.c:736 kobject_put+0x80/0x350
  RIP: 0010:kobject_put+0x80/0x350
  ::
  Call Trace:
  btrfs_sysfs_remove_devices_dir+0x6e/0x160 [btrfs]
  btrfs_rm_device.cold+0xa8/0x298 [btrfs]
  btrfs_ioctl+0x206c/0x22a0 [btrfs]
  ksys_ioctl+0xe2/0x140
  __x64_sys_ioctl+0x1e/0x29
  do_syscall_64+0x96/0x150
  entry_SYSCALL_64_after_hwframe+0x44/0xa9
  RIP: 0033:0x7f4047c6288b
  ::

This is because, at the end of the seed device-delete, we try to remove
the seed's devid sysfs entry. But for the seed devices under the sprout
fs, we don't initialize the devid kobject yet. So add a kobject state
check, which takes care of the bug.

Fixes: 668e48af ("btrfs: sysfs, add devid/dev_state kobject and device attributes")
CC: stable@vger.kernel.org # 5.6+
Signed-off-by: default avatarAnand Jain <anand.jain@oracle.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 35be8851
...@@ -1170,10 +1170,12 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices, ...@@ -1170,10 +1170,12 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices,
disk_kobj->name); disk_kobj->name);
} }
if (one_device->devid_kobj.state_initialized) {
kobject_del(&one_device->devid_kobj); kobject_del(&one_device->devid_kobj);
kobject_put(&one_device->devid_kobj); kobject_put(&one_device->devid_kobj);
wait_for_completion(&one_device->kobj_unregister); wait_for_completion(&one_device->kobj_unregister);
}
return 0; return 0;
} }
...@@ -1186,11 +1188,13 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices, ...@@ -1186,11 +1188,13 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices,
sysfs_remove_link(fs_devices->devices_kobj, sysfs_remove_link(fs_devices->devices_kobj,
disk_kobj->name); disk_kobj->name);
} }
if (one_device->devid_kobj.state_initialized) {
kobject_del(&one_device->devid_kobj); kobject_del(&one_device->devid_kobj);
kobject_put(&one_device->devid_kobj); kobject_put(&one_device->devid_kobj);
wait_for_completion(&one_device->kobj_unregister); wait_for_completion(&one_device->kobj_unregister);
} }
}
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment