forked from mirrors/linux
		
	kernfs: fix locking around kernfs_ops->release() callback
The release callback may be called from two places - file release
operation and kernfs open file draining.  kernfs_open_file->mutex is
used to synchronize the two callsites.  This unfortunately leads to
possible circular locking because of->mutex is used to protect the
usual kernfs operations which may use locking constructs which are
held while removing and thus draining kernfs files.
@of->mutex is for synchronizing concurrent kernfs access operations
and all we need here is synchronization between the releaes and drain
paths.  As the drain path has to grab kernfs_open_file_mutex anyway,
let's use the mutex to synchronize the release operation instead.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Tony Lindgren <tony@atomide.com>
Fixes: 0e67db2f9f ("kernfs: add kernfs_ops->open/release() callbacks")
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
			
			
This commit is contained in:
		
							parent
							
								
									63f1ca5945
								
							
						
					
					
						commit
						f83f3c5156
					
				
					 1 changed files with 14 additions and 5 deletions
				
			
		| 
						 | 
					@ -747,10 +747,15 @@ static int kernfs_fop_open(struct inode *inode, struct file *file)
 | 
				
			||||||
static void kernfs_release_file(struct kernfs_node *kn,
 | 
					static void kernfs_release_file(struct kernfs_node *kn,
 | 
				
			||||||
				struct kernfs_open_file *of)
 | 
									struct kernfs_open_file *of)
 | 
				
			||||||
{
 | 
					{
 | 
				
			||||||
	if (!(kn->flags & KERNFS_HAS_RELEASE))
 | 
						/*
 | 
				
			||||||
		return;
 | 
						 * @of is guaranteed to have no other file operations in flight and
 | 
				
			||||||
 | 
						 * we just want to synchronize release and drain paths.
 | 
				
			||||||
 | 
						 * @kernfs_open_file_mutex is enough.  @of->mutex can't be used
 | 
				
			||||||
 | 
						 * here because drain path may be called from places which can
 | 
				
			||||||
 | 
						 * cause circular dependency.
 | 
				
			||||||
 | 
						 */
 | 
				
			||||||
 | 
						lockdep_assert_held(&kernfs_open_file_mutex);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	mutex_lock(&of->mutex);
 | 
					 | 
				
			||||||
	if (!of->released) {
 | 
						if (!of->released) {
 | 
				
			||||||
		/*
 | 
							/*
 | 
				
			||||||
		 * A file is never detached without being released and we
 | 
							 * A file is never detached without being released and we
 | 
				
			||||||
| 
						 | 
					@ -760,7 +765,6 @@ static void kernfs_release_file(struct kernfs_node *kn,
 | 
				
			||||||
		kn->attr.ops->release(of);
 | 
							kn->attr.ops->release(of);
 | 
				
			||||||
		of->released = true;
 | 
							of->released = true;
 | 
				
			||||||
	}
 | 
						}
 | 
				
			||||||
	mutex_unlock(&of->mutex);
 | 
					 | 
				
			||||||
}
 | 
					}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
static int kernfs_fop_release(struct inode *inode, struct file *filp)
 | 
					static int kernfs_fop_release(struct inode *inode, struct file *filp)
 | 
				
			||||||
| 
						 | 
					@ -768,7 +772,12 @@ static int kernfs_fop_release(struct inode *inode, struct file *filp)
 | 
				
			||||||
	struct kernfs_node *kn = filp->f_path.dentry->d_fsdata;
 | 
						struct kernfs_node *kn = filp->f_path.dentry->d_fsdata;
 | 
				
			||||||
	struct kernfs_open_file *of = kernfs_of(filp);
 | 
						struct kernfs_open_file *of = kernfs_of(filp);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	kernfs_release_file(kn, of);
 | 
						if (kn->flags & KERNFS_HAS_RELEASE) {
 | 
				
			||||||
 | 
							mutex_lock(&kernfs_open_file_mutex);
 | 
				
			||||||
 | 
							kernfs_release_file(kn, of);
 | 
				
			||||||
 | 
							mutex_unlock(&kernfs_open_file_mutex);
 | 
				
			||||||
 | 
						}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	kernfs_put_open_node(kn, of);
 | 
						kernfs_put_open_node(kn, of);
 | 
				
			||||||
	seq_release(inode, filp);
 | 
						seq_release(inode, filp);
 | 
				
			||||||
	kfree(of->prealloc_buf);
 | 
						kfree(of->prealloc_buf);
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
		Reference in a new issue