diff mbox series

[2/3] ch: synchronize ch_probe() and ch_open()

Message ID 20200213153207.123357-3-hare@suse.de (mailing list archive)
State Accepted
Headers show
Series ch: fixup refcounting imbalance for SCSI devices | expand

Commit Message

Hannes Reinecke Feb. 13, 2020, 3:32 p.m. UTC 
The 'ch' device node is created before the configuration is
being read in, which leads to a race window when ch_open() is called
before that.
To avoid any races we should be taking the device mutex during
ch_readconfig() and ch_init_elem(), and also during ch_open().
That ensures ch_probe is finished before ch_open() completes.

Signed-off-by: Hannes Reinecke <hare@suse.de>
---
 drivers/scsi/ch.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

Comments

Bart Van Assche Feb. 20, 2020, 4:51 a.m. UTC | #1 
On 2020-02-13 07:32, Hannes Reinecke wrote:
> The 'ch' device node is created before the configuration is
> being read in, which leads to a race window when ch_open() is called
> before that.
> To avoid any races we should be taking the device mutex during
> ch_readconfig() and ch_init_elem(), and also during ch_open().
> That ensures ch_probe is finished before ch_open() completes.

Reviewed-by: Bart Van Assche <bvanassche@acm.org>
diff mbox series

Patch

diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c
index 974afb4bd5fe..9cbfb00ab950 100644
--- a/drivers/scsi/ch.c
+++ b/drivers/scsi/ch.c
@@ -606,7 +606,10 @@  ch_open(struct inode *inode, struct file *file)
 		mutex_unlock(&ch_mutex);
 		return -ENXIO;
 	}
+	/* Synchronize with ch_probe() */
+	mutex_lock(&ch->lock);
 	file->private_data = ch;
+	mutex_unlock(&ch->lock);
 	mutex_unlock(&ch_mutex);
 	return 0;
 }
@@ -949,6 +952,9 @@  static int ch_probe(struct device *dev)
 		goto remove_idr;
 	}
 
+	mutex_init(&ch->lock);
+	kref_init(&ch->ref);
+	ch->device = sd;
 	class_dev = device_create(ch_sysfs_class, dev,
 				  MKDEV(SCSI_CHANGER_MAJOR, ch->minor), ch,
 				  "s%s", ch->name);
@@ -959,15 +965,16 @@  static int ch_probe(struct device *dev)
 		goto put_device;
 	}
 
-	mutex_init(&ch->lock);
-	kref_init(&ch->ref);
-	ch->device = sd;
+	mutex_lock(&ch->lock);
 	ret = ch_readconfig(ch);
-	if (ret)
+	if (ret) {
+		mutex_unlock(&ch->lock);
 		goto destroy_dev;
+	}
 	if (init)
 		ch_init_elem(ch);
 
+	mutex_unlock(&ch->lock);
 	dev_set_drvdata(dev, ch);
 	sdev_printk(KERN_INFO, sd, "Attached scsi changer %s\n", ch->name);