Received: by 2002:a25:d7c1:0:0:0:0:0 with SMTP id o184csp2487945ybg; Sun, 27 Oct 2019 19:49:33 -0700 (PDT) X-Google-Smtp-Source: APXvYqxUrhnby+C76Pb7zznZhcRDlZcDxSkJsHeFARN95rRAWEaMnXK7cdcR6ssSIn4Mcy3wrhcX X-Received: by 2002:a17:906:6943:: with SMTP id c3mr14661552ejs.161.1572230973603; Sun, 27 Oct 2019 19:49:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1572230973; cv=none; d=google.com; s=arc-20160816; b=hZx/qjlCpVYoZo+ann9tEEY8QVrSaz7MPSdny8jkFtuYxqUkxCEpNhO8RsyUsDdEOv DNr0bwWQvtBcu8bg46MPu/vrnF2z0jwN05+ERPgniaK3F40sONwMAcEs0C0YlbMH0Kuc zAMsR396eL+SEIm5ve+/GvIqInZGXG5VmbdNt3vKIuJe8fnafJbX5X3s5nf49lKVig5P oZYEU6e1KuOPJ6KE2l2NMC18LDuq9PitP6MpvhAt1Nk3b1g7i5HM/RZmXoTxfqodnEK8 3xfooTC/GU6ZyBIxqHX42XfnbDPNWE179HIZnx25vvZW7A4SYcQ4pQmW34wxqzPAEHaC iI9w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=5ywqUj9oGI31K5U2alfYKsuI8xyq6roSLmjJ/BVku9E=; b=mOPdyiRJBs5NGHG0Aicr2UMtjmwBmn0y1hK6CWt5zdXuZT2Vy8K7h4LkL30UbgoNhg ovYa//ECIo5TcODe62cs4QlbQ6hyyD1Yyc87QXt34RjnOamx5BjtdMk61Kd5Nq91+tXB zB6mD4peP8oES6BMqqOWo0JktcEDQncJ64udE/UWBVMLl3Fr7CWpJWPxyodyZJvgRaFH zaU92r3J+pOtmRLWPjN4n0NjYvRlJzs19oWvxiWVEj9RFWb2VoD9IqD+phEsPZs/DoAf SM0PRGbT/SyZANd6ygnCUm8hv800l5qg0of1kDLNcpvKPp+EDIo6JKnqWO26eGxXZlHe 1Z6A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=HBvQq9VR; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id p9si6535193edc.96.2019.10.27.19.49.09; Sun, 27 Oct 2019 19:49:33 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=HBvQq9VR; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729160AbfJ0VLA (ORCPT + 99 others); Sun, 27 Oct 2019 17:11:00 -0400 Received: from mail.kernel.org ([198.145.29.99]:57434 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729803AbfJ0VK6 (ORCPT ); Sun, 27 Oct 2019 17:10:58 -0400 Received: from localhost (100.50.158.77.rev.sfr.net [77.158.50.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 68369214AF; Sun, 27 Oct 2019 21:10:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1572210657; bh=eYt9bNR4hsgMMTimXo/ASnjAaT0LBoTAxZWzmk/h4+Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HBvQq9VRw7ENbDcb7QmNgUi1DFIPBHB6AfbZpmtWC+lIR8kFT+qJTSXS9JyX63sl4 8Y/opHd9LVkHw7Et8vP7VZOkB1hscCF763HbMknIDGxsutPUGFxae0ZOL9I1JtrbkW CrBM85bSJ6idx+xhi7tw8CK3klddo/IXCAnTmbnI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yufen Yu , Bart Van Assche , "Martin K. Petersen" Subject: [PATCH 4.14 089/119] scsi: core: try to get module before removing device Date: Sun, 27 Oct 2019 22:01:06 +0100 Message-Id: <20191027203348.088831528@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191027203259.948006506@linuxfoundation.org> References: <20191027203259.948006506@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Yufen Yu commit 77c301287ebae86cc71d03eb3806f271cb14da79 upstream. We have a test case like block/001 in blktests, which will create a scsi device by loading scsi_debug module and then try to delete the device by sysfs interface. At the same time, it may remove the scsi_debug module. And getting a invalid paging request BUG_ON as following: [ 34.625854] BUG: unable to handle page fault for address: ffffffffa0016bb8 [ 34.629189] Oops: 0000 [#1] SMP PTI [ 34.629618] CPU: 1 PID: 450 Comm: bash Tainted: G W 5.4.0-rc3+ #473 [ 34.632524] RIP: 0010:scsi_proc_hostdir_rm+0x5/0xa0 [ 34.643555] CR2: ffffffffa0016bb8 CR3: 000000012cd88000 CR4: 00000000000006e0 [ 34.644545] Call Trace: [ 34.644907] scsi_host_dev_release+0x6b/0x1f0 [ 34.645511] device_release+0x74/0x110 [ 34.646046] kobject_put+0x116/0x390 [ 34.646559] put_device+0x17/0x30 [ 34.647041] scsi_target_dev_release+0x2b/0x40 [ 34.647652] device_release+0x74/0x110 [ 34.648186] kobject_put+0x116/0x390 [ 34.648691] put_device+0x17/0x30 [ 34.649157] scsi_device_dev_release_usercontext+0x2e8/0x360 [ 34.649953] execute_in_process_context+0x29/0x80 [ 34.650603] scsi_device_dev_release+0x20/0x30 [ 34.651221] device_release+0x74/0x110 [ 34.651732] kobject_put+0x116/0x390 [ 34.652230] sysfs_unbreak_active_protection+0x3f/0x50 [ 34.652935] sdev_store_delete.cold.4+0x71/0x8f [ 34.653579] dev_attr_store+0x1b/0x40 [ 34.654103] sysfs_kf_write+0x3d/0x60 [ 34.654603] kernfs_fop_write+0x174/0x250 [ 34.655165] __vfs_write+0x1f/0x60 [ 34.655639] vfs_write+0xc7/0x280 [ 34.656117] ksys_write+0x6d/0x140 [ 34.656591] __x64_sys_write+0x1e/0x30 [ 34.657114] do_syscall_64+0xb1/0x400 [ 34.657627] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 34.658335] RIP: 0033:0x7f156f337130 During deleting scsi target, the scsi_debug module have been removed. Then, sdebug_driver_template belonged to the module cannot be accessd, resulting in scsi_proc_hostdir_rm() BUG_ON. To fix the bug, we add scsi_device_get() in sdev_store_delete() to try to increase refcount of module, avoiding the module been removed. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191015130556.18061-1-yuyufen@huawei.com Signed-off-by: Yufen Yu Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/scsi_sysfs.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -722,6 +722,14 @@ sdev_store_delete(struct device *dev, st const char *buf, size_t count) { struct kernfs_node *kn; + struct scsi_device *sdev = to_scsi_device(dev); + + /* + * We need to try to get module, avoiding the module been removed + * during delete. + */ + if (scsi_device_get(sdev)) + return -ENODEV; kn = sysfs_break_active_protection(&dev->kobj, &attr->attr); WARN_ON_ONCE(!kn); @@ -736,9 +744,10 @@ sdev_store_delete(struct device *dev, st * state into SDEV_DEL. */ device_remove_file(dev, attr); - scsi_remove_device(to_scsi_device(dev)); + scsi_remove_device(sdev); if (kn) sysfs_unbreak_active_protection(kn); + scsi_device_put(sdev); return count; }; static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete);