https://github.com/torvalds/linux
Revision a05b7ea03d72f36edb0cec05e8893803335c61a0 authored by NeilBrown on 19 July 2012, 05:59:18 UTC, committed by NeilBrown on 19 July 2012, 05:59:18 UTC
md will refuse to stop an array if any other fd (or mounted fs) is using it. When any fs is unmounted of when the last open fd is closed all pending IO will be flushed (e.g. sync_blockdev call in __blkdev_put) so there will be no pending IO to worry about when the array is stopped. However in order to send the STOP_ARRAY ioctl to stop the array one must first get and open fd on the block device. If some fd is being used to write to the block device and it is closed after mdadm open the block device, but before mdadm issues the STOP_ARRAY ioctl, then there will be no last-close on the md device so __blkdev_put will not call sync_blockdev. If this happens, then IO can still be in-flight while md tears down the array and bad things can happen (use-after-free and subsequent havoc). So in the case where do_md_stop is being called from an open file descriptor, call sync_block after taking the mutex to ensure there will be no new openers. This is needed when setting a read-write device to read-only too. Cc: stable@vger.kernel.org Reported-by: majianpeng <majianpeng@gmail.com> Signed-off-by: NeilBrown <neilb@suse.de>
1 parent 25f7fd4
Tip revision: a05b7ea03d72f36edb0cec05e8893803335c61a0 authored by NeilBrown on 19 July 2012, 05:59:18 UTC
md: avoid crash when stopping md array races with closing other open fds.
md: avoid crash when stopping md array races with closing other open fds.
Tip revision: a05b7ea
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| arch | ||
| block | ||
| crypto | ||
| drivers | ||
| firmware | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .gitignore | -rw-r--r-- | 1014 bytes |
| .mailmap | -rw-r--r-- | 4.4 KB |
| COPYING | -rw-r--r-- | 18.3 KB |
| CREDITS | -rw-r--r-- | 92.7 KB |
| Kbuild | -rw-r--r-- | 2.5 KB |
| Kconfig | -rw-r--r-- | 252 bytes |
| MAINTAINERS | -rw-r--r-- | 208.2 KB |
| Makefile | -rw-r--r-- | 46.0 KB |
| README | -rw-r--r-- | 17.3 KB |
| REPORTING-BUGS | -rw-r--r-- | 3.3 KB |
Computing file changes ...
