From: NeilBrown Date: Mon, 6 Feb 2017 02:41:39 +0000 (+1100) Subject: md: ensure md devices are freed before module is unloaded. X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=9356863c9409efc79029c01a85d015efae977e69;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git md: ensure md devices are freed before module is unloaded. Commit: cbd199837750 ("md: Fix unfortunate interaction with evms") change mddev_put() so that it would not destroy an md device while ->ctime was non-zero. Unfortunately, we didn't make sure to clear ->ctime when unloading the module, so it is possible for an md device to remain after module unload. An attempt to open such a device will trigger an invalid memory reference in: get_gendisk -> kobj_lookup -> exact_lock -> get_disk when tring to access disk->fops, which was in the module that has been removed. So ensure we clear ->ctime in md_exit(), and explain how that is useful, as it isn't immediately obvious when looking at the code. Fixes: cbd199837750 ("md: Fix unfortunate interaction with evms") Tested-by: Guoqing Jiang Signed-off-by: NeilBrown Signed-off-by: Shaohua Li --- diff --git a/drivers/md/md.c b/drivers/md/md.c index 01175dac0db6..13020e5c8cc0 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -8980,7 +8980,14 @@ static __exit void md_exit(void) for_each_mddev(mddev, tmp) { export_array(mddev); + mddev->ctime = 0; mddev->hold_active = 0; + /* + * for_each_mddev() will call mddev_put() at the end of each + * iteration. As the mddev is now fully clear, this will + * schedule the mddev for destruction by a workqueue, and the + * destroy_workqueue() below will wait for that to complete. + */ } destroy_workqueue(md_misc_wq); destroy_workqueue(md_wq);