2013-06-05 06:03:32

by Alexey Kardashevskiy

Subject: [PATCH] vfio: fix crash on rmmod

devtmpfs_delete_node() calls devnode() callback with mode==NULL but
vfio still tries to write there.

The patch fixes this.

Signed-off-by: Alexey Kardashevskiy <[email protected]>

---

Steps to reproduce on freshly booted system with no devices given to VFIO:
modprobe vfio
rmmod vfio_iommu_spapr_tce
rmmod vfio
---
drivers/vfio/vfio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index 523c121..259ad28 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -1360,7 +1360,7 @@ static const struct file_operations vfio_device_fops = {
*/
static char *vfio_devnode(struct device *dev, umode_t *mode)
{
- if (MINOR(dev->devt) == 0)
+ if (mode && (MINOR(dev->devt) == 0))
*mode = S_IRUGO | S_IWUGO;

return kasprintf(GFP_KERNEL, "vfio/%s", dev_name(dev));
--
1.7.10.4

2013-06-05 15:11:26

by Alex Williamson

Subject: Re: [PATCH] vfio: fix crash on rmmod

On Wed, 2013-06-05 at 16:03 +1000, Alexey Kardashevskiy wrote:
> devtmpfs_delete_node() calls devnode() callback with mode==NULL but
> vfio still tries to write there.
>
> The patch fixes this.
>
> Signed-off-by: Alexey Kardashevskiy <[email protected]>
>
> ---

Oops. Applied. The mode change just went in for 3.10, so I'll get this
in before the final rc. Thanks,

Alex

> Steps to reproduce on freshly booted system with no devices given to VFIO:
> modprobe vfio
> rmmod vfio_iommu_spapr_tce
> rmmod vfio
> ---
> drivers/vfio/vfio.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
> index 523c121..259ad28 100644
> --- a/drivers/vfio/vfio.c
> +++ b/drivers/vfio/vfio.c
> @@ -1360,7 +1360,7 @@ static const struct file_operations vfio_device_fops = {
> */
> static char *vfio_devnode(struct device *dev, umode_t *mode)
> {
> - if (MINOR(dev->devt) == 0)
> + if (mode && (MINOR(dev->devt) == 0))
> *mode = S_IRUGO | S_IWUGO;
>
> return kasprintf(GFP_KERNEL, "vfio/%s", dev_name(dev));