From: Luis Chamberlain <mcgrof@kernel.org>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: minchan@kernel.org, jeyu@kernel.org, ngupta@vflare.org,
sergey.senozhatsky.work@gmail.com, axboe@kernel.dk,
mbenes@suse.com, jpoimboe@redhat.com, tglx@linutronix.de,
keescook@chromium.org, jikos@kernel.org, rostedt@goodmis.org,
peterz@infradead.org, linux-block@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v3 2/3] zram: fix deadlock with sysfs attribute usage and driver removal
Date: Tue, 22 Jun 2021 10:27:12 -0700 [thread overview]
Message-ID: <20210622172712.3bdlxnsghmbn6nry@garbanzo> (raw)
In-Reply-To: <YNIa8tym7TmZFWaZ@kroah.com>
On Tue, Jun 22, 2021 at 07:16:34PM +0200, Greg KH wrote:
> On Tue, Jun 22, 2021 at 09:32:08AM -0700, Luis Chamberlain wrote:
> > On Tue, Jun 22, 2021 at 09:45:39AM +0200, Greg KH wrote:
> > > On Mon, Jun 21, 2021 at 04:36:34PM -0700, Luis Chamberlain wrote:
> > > > @@ -2048,13 +2048,19 @@ static ssize_t hot_add_show(struct class *class,
> > > > {
> > > > int ret;
> > > >
> > > > + if (!try_module_get(THIS_MODULE))
> > > > + return -ENODEV;
> > > > +
> > >
> > > You can not increment/decrement your own module's reference count and
> > > expect it to work properly, as it is still a race.
> >
> > The goal here is to prevent an rmmod call if this succeeds. If it
> > succeeds then any subsequent rmmod will fail. Can you explain how
> > this is still racy?
>
> {sigh}
>
> What happens if the driver core is just about to call hot_add_show() and
> the module is removed from the system. It then calls to the memory
> location that hot_add_show() was previously at, but now that is not a
> valid pointer to code, and boom.
The new kobject_get() on patch 3/3 ensures that the device will be up
throughout the entire life of the store call, and thus prevent the
code being executed being removed, no?
Luis
next prev parent reply other threads:[~2021-06-22 17:27 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-21 23:30 [PATCH v3 0/3] zram: fix few sysfs races Luis Chamberlain
2021-06-21 23:30 ` [PATCH v3 1/3] zram: fix crashes due to use of cpu hotplug multistate Luis Chamberlain
2021-06-22 7:39 ` Greg KH
2021-06-22 15:12 ` Luis Chamberlain
2021-06-21 23:36 ` [PATCH v3 2/3] zram: fix deadlock with sysfs attribute usage and driver removal Luis Chamberlain
2021-06-22 7:41 ` Greg KH
2021-06-22 15:27 ` Luis Chamberlain
2021-06-22 16:27 ` Greg KH
2021-06-22 16:40 ` Luis Chamberlain
2021-06-22 16:51 ` Greg KH
2021-06-22 17:00 ` Luis Chamberlain
2021-06-22 7:45 ` Greg KH
2021-06-22 16:32 ` Luis Chamberlain
2021-06-22 17:16 ` Greg KH
2021-06-22 17:27 ` Luis Chamberlain [this message]
2021-06-22 18:05 ` Greg KH
2021-06-22 19:57 ` Luis Chamberlain
2021-06-21 23:36 ` [PATCH v3 3/3] drivers/base/core: refcount kobject and bus on device attribute read / store Luis Chamberlain
2021-06-22 7:46 ` Greg KH
2021-06-22 16:44 ` Luis Chamberlain
2021-06-22 16:48 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210622172712.3bdlxnsghmbn6nry@garbanzo \
--to=mcgrof@kernel.org \
--cc=axboe@kernel.dk \
--cc=gregkh@linuxfoundation.org \
--cc=jeyu@kernel.org \
--cc=jikos@kernel.org \
--cc=jpoimboe@redhat.com \
--cc=keescook@chromium.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mbenes@suse.com \
--cc=minchan@kernel.org \
--cc=ngupta@vflare.org \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=sergey.senozhatsky.work@gmail.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).