From patchwork Wed Mar 20 11:39:40 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hannes Reinecke X-Patchwork-Id: 10861439 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 049CC13B5 for ; Wed, 20 Mar 2019 11:39:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DA1B529826 for ; Wed, 20 Mar 2019 11:39:48 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CB6E429916; Wed, 20 Mar 2019 11:39:48 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7934A29826 for ; Wed, 20 Mar 2019 11:39:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727843AbfCTLjs (ORCPT ); Wed, 20 Mar 2019 07:39:48 -0400 Received: from mx2.suse.de ([195.135.220.15]:58366 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727154AbfCTLjr (ORCPT ); Wed, 20 Mar 2019 07:39:47 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 54A9CADED; Wed, 20 Mar 2019 11:39:46 +0000 (UTC) From: Hannes Reinecke To: "Martin K. Petersen" Cc: Christoph Hellwig , James Bottomley , linux-scsi@vger.kernel.org, Hannes Reinecke Subject: [PATCH 1/2] ch: add missing mutex_lock()/mutex_unlock() in ch_release() Date: Wed, 20 Mar 2019 12:39:40 +0100 Message-Id: <20190320113941.62117-2-hare@suse.de> X-Mailer: git-send-email 2.16.4 In-Reply-To: <20190320113941.62117-1-hare@suse.de> References: <20190320113941.62117-1-hare@suse.de> Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The 'ch_mutex" is meant to guard against modifications of file->private_data, so we need to take in in ch_release() as well as in ch_open(). Signed-off-by: Hannes Reinecke --- drivers/scsi/ch.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c index 1c5051b1c125..8f426903d7e4 100644 --- a/drivers/scsi/ch.c +++ b/drivers/scsi/ch.c @@ -577,9 +577,11 @@ ch_release(struct inode *inode, struct file *file) { scsi_changer *ch = file->private_data; + mutex_lock(&ch_mutex); scsi_device_put(ch->device); ch->device = NULL; file->private_data = NULL; + mutex_unlock(&ch_mutex); kref_put(&ch->ref, ch_destroy); return 0; } From patchwork Wed Mar 20 11:39:41 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hannes Reinecke X-Patchwork-Id: 10861441 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 38A7817EF for ; Wed, 20 Mar 2019 11:39:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1E51F2968D for ; Wed, 20 Mar 2019 11:39:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1228E29761; Wed, 20 Mar 2019 11:39:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B60092985D for ; Wed, 20 Mar 2019 11:39:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727927AbfCTLjs (ORCPT ); Wed, 20 Mar 2019 07:39:48 -0400 Received: from mx2.suse.de ([195.135.220.15]:58382 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727619AbfCTLjs (ORCPT ); Wed, 20 Mar 2019 07:39:48 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 0A481AD38; Wed, 20 Mar 2019 11:39:47 +0000 (UTC) From: Hannes Reinecke To: "Martin K. Petersen" Cc: Christoph Hellwig , James Bottomley , linux-scsi@vger.kernel.org, Hannes Reinecke Subject: [PATCH 2/2] ch: fixup refcounting imbalance for SCSI devices Date: Wed, 20 Mar 2019 12:39:41 +0100 Message-Id: <20190320113941.62117-3-hare@suse.de> X-Mailer: git-send-email 2.16.4 In-Reply-To: <20190320113941.62117-1-hare@suse.de> References: <20190320113941.62117-1-hare@suse.de> Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The SCSI device is required to be present during 'ch_probe' and ch_open(), but as we cannot known whether ch_release() or ch_remove() will be called first we should blank out the pointer to the SCSI device in ch_destroy(), not in ch_release(). Signed-off-by: Hannes Reinecke --- drivers/scsi/ch.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c index 8f426903d7e4..08acd896d4e2 100644 --- a/drivers/scsi/ch.c +++ b/drivers/scsi/ch.c @@ -568,6 +568,7 @@ static void ch_destroy(struct kref *ref) { scsi_changer *ch = container_of(ref, scsi_changer, ref); + ch->device = NULL; kfree(ch->dt); kfree(ch); } @@ -579,7 +580,6 @@ ch_release(struct inode *inode, struct file *file) mutex_lock(&ch_mutex); scsi_device_put(ch->device); - ch->device = NULL; file->private_data = NULL; mutex_unlock(&ch_mutex); kref_put(&ch->ref, ch_destroy); @@ -596,14 +596,17 @@ ch_open(struct inode *inode, struct file *file) spin_lock(&ch_index_lock); ch = idr_find(&ch_index_idr, minor); - if (NULL == ch || scsi_device_get(ch->device)) { + if (NULL == ch || kref_get_unless_zero(&ch->ref)) { spin_unlock(&ch_index_lock); mutex_unlock(&ch_mutex); return -ENXIO; } - kref_get(&ch->ref); spin_unlock(&ch_index_lock); + if (!ch->device || scsi_device_get(ch->device)) { + kref_put(&ch->ref, ch_destroy); + return -ENXIO; + } file->private_data = ch; mutex_unlock(&ch_mutex); return 0; @@ -976,6 +979,7 @@ static int ch_remove(struct device *dev) spin_lock(&ch_index_lock); idr_remove(&ch_index_idr, ch->minor); + dev_set_drvdata(dev, NULL); spin_unlock(&ch_index_lock); device_destroy(ch_sysfs_class, MKDEV(SCSI_CHANGER_MAJOR,ch->minor));