Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S262006AbUCaPLl (ORCPT ); Wed, 31 Mar 2004 10:11:41 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S262017AbUCaPLl (ORCPT ); Wed, 31 Mar 2004 10:11:41 -0500 Received: from ida.rowland.org ([192.131.102.52]:5124 "HELO ida.rowland.org") by vger.kernel.org with SMTP id S262006AbUCaPLi (ORCPT ); Wed, 31 Mar 2004 10:11:38 -0500 Date: Wed, 31 Mar 2004 10:11:37 -0500 (EST) From: Alan Stern X-X-Sender: stern@ida.rowland.org To: Maneesh Soni cc: Andrew Morton , Benjamin Herrenschmidt , , , , , , Subject: Re: [linux-usb-devel] [PATCH] back out sysfs reference count change In-Reply-To: <20040331092631.GA21484@in.ibm.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1375 Lines: 36 On Wed, 31 Mar 2004, Maneesh Soni wrote: > For convenience I will explain the race here.. > > cpu 0 cpu 1 > kobject_unregister() sysfs_open_file() > kobject_del() check_perm() > sysfs_remove_dir() : > (dentry remains alive due to ref. taken : > on the way to sysfs_open_file) : > kobject_put() : > kobject_cleanup() kobject_get(->d_fsdata) > > cpu 1 could end up referring to a freed kobject through dentry->d_fsdata or > starts spitting Badness in kobject_get at lib/kobject.c:429. For triggering > this race try running these two loops simultaneously on SMP > > # while true; do insmod drivers/net/dummy.ko; rmmod dummy; done > # while true; do find /sys/class/net | xargs cat; done > > Probably it can be solved by making sure that when sysfs file is > opened/read/written some _race_ free check is done and fail if kobject if gone. > > Maneesh Here's a suggestion. At the start of check_perm() grab the dentry semaphore, then check whether d_fsdata is NULL, if it isn't then do the kobject_get(), then unlock the semaphore. Alan Stern - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/