Michael Tsirkin found a race condition in the irqfd code where we may allow the underlying eventfd object to race with the rmmod of kvm.ko.
Since we now use eventfd_notifier for irqfd, lets add a struct module *owner field to properly maintain references to our registered signal handlers. Found-by: Michael S. Tsirkin <[email protected]> CC: Davide Libenzi <[email protected]> Signed-off-by: Gregory Haskins <[email protected]> --- fs/eventfd.c | 8 ++++++++ include/linux/eventfd.h | 3 +++ 2 files changed, 11 insertions(+), 0 deletions(-) diff --git a/fs/eventfd.c b/fs/eventfd.c index 505d5de..babedb3 100644 --- a/fs/eventfd.c +++ b/fs/eventfd.c @@ -108,9 +108,12 @@ static int eventfd_release(struct inode *inode, struct file *file) * path */ list_for_each_entry_safe(en, tmp, &ctx->nh, list) { + struct module *owner = en->owner; + list_del(&en->list); if (en->ops->release) en->ops->release(en); + module_put(owner); } synchronize_srcu(&ctx->srcu); @@ -261,6 +264,9 @@ static int _eventfd_notifier_register(struct eventfd_ctx *ctx, { unsigned long flags; + if (!try_module_get(en->owner)) + return -EINVAL; + spin_lock_irqsave(&ctx->wqh.lock, flags); list_add_tail_rcu(&en->list, &ctx->nh); spin_unlock_irqrestore(&ctx->wqh.lock, flags); @@ -292,6 +298,8 @@ int eventfd_notifier_unregister(struct file *file, struct eventfd_notifier *en) synchronize_srcu(&ctx->srcu); + module_put(en->owner); + return 0; } EXPORT_SYMBOL_GPL(eventfd_notifier_unregister); diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h index 0218cf6..f534bcd 100644 --- a/include/linux/eventfd.h +++ b/include/linux/eventfd.h @@ -9,6 +9,7 @@ #define _LINUX_EVENTFD_H #include <linux/list.h> +#include <linux/module.h> struct eventfd_notifier; @@ -18,6 +19,7 @@ struct eventfd_notifier_ops { }; struct eventfd_notifier { + struct module *owner; struct list_head list; const struct eventfd_notifier_ops *ops; }; @@ -26,6 +28,7 @@ static inline void eventfd_notifier_init(struct eventfd_notifier *en, const struct eventfd_notifier_ops *ops) { memset(en, 0, sizeof(*en)); + en->owner = THIS_MODULE; INIT_LIST_HEAD(&en->list); en->ops = ops; } -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
