mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-06 19:07:52 +00:00
configfs: fix registered group removal
[ Upstream commit cc57c07343
]
This patch fixes a bug where configfs_register_group had added
a group in a tree, and userspace has done a rmdir on a dir somewhere
above that group and we hit a kernel crash. The problem is configfs_rmdir
will detach everything under it and unlink groups on the default_groups
list. It will not unlink groups added with configfs_register_group so when
configfs_unregister_group is called to drop its references to the group/items
we crash when we try to access the freed dentrys.
The patch just adds a check for if a rmdir has been done above
us and if so just does the unlink part of unregistration.
Sorry if you are getting this multiple times. I thouhgt I sent
this to some of you and lkml, but I do not see it.
Signed-off-by: Mike Christie <mchristi@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
c2bd54bc22
commit
bc87baee19
1 changed files with 11 additions and 0 deletions
|
@ -1777,6 +1777,16 @@ void configfs_unregister_group(struct config_group *group)
|
|||
struct dentry *dentry = group->cg_item.ci_dentry;
|
||||
struct dentry *parent = group->cg_item.ci_parent->ci_dentry;
|
||||
|
||||
mutex_lock(&subsys->su_mutex);
|
||||
if (!group->cg_item.ci_parent->ci_group) {
|
||||
/*
|
||||
* The parent has already been unlinked and detached
|
||||
* due to a rmdir.
|
||||
*/
|
||||
goto unlink_group;
|
||||
}
|
||||
mutex_unlock(&subsys->su_mutex);
|
||||
|
||||
inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
|
||||
spin_lock(&configfs_dirent_lock);
|
||||
configfs_detach_prep(dentry, NULL);
|
||||
|
@ -1791,6 +1801,7 @@ void configfs_unregister_group(struct config_group *group)
|
|||
dput(dentry);
|
||||
|
||||
mutex_lock(&subsys->su_mutex);
|
||||
unlink_group:
|
||||
unlink_group(group);
|
||||
mutex_unlock(&subsys->su_mutex);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue