Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity
android_kernel_google_msm/lib
History
Linus Torvalds 2931b31ff9 kobject: fix kset_find_obj() race with concurrent last kobject_put() 
commit a49b7e82ca upstream.

Anatol Pomozov identified a race condition that hits module unloading
and re-loading.  To quote Anatol:

 "This is a race codition that exists between kset_find_obj() and
  kobject_put().  kset_find_obj() might return kobject that has refcount
  equal to 0 if this kobject is freeing by kobject_put() in other
  thread.

  Here is timeline for the crash in case if kset_find_obj() searches for
  an object tht nobody holds and other thread is doing kobject_put() on
  the same kobject:

    THREAD A (calls kset_find_obj())     THREAD B (calls kobject_put())
    splin_lock()
                                         atomic_dec_return(kobj->kref), counter gets zero here
                                         ... starts kobject cleanup ....
                                         spin_lock() // WAIT thread A in kobj_kset_leave()
    iterate over kset->list
    atomic_inc(kobj->kref) (counter becomes 1)
    spin_unlock()
                                         spin_lock() // taken
                                         // it does not know that thread A increased counter so it
                                         remove obj from list
                                         spin_unlock()
                                         vfree(module) // frees module object with containing kobj

    // kobj points to freed memory area!!
    kobject_put(kobj) // OOPS!!!!

  The race above happens because module.c tries to use kset_find_obj()
  when somebody unloads module.  The module.c code was introduced in
  commit 6494a93d55fa"

Anatol supplied a patch specific for module.c that worked around the
problem by simply not using kset_find_obj() at all, but rather than make
a local band-aid, this just fixes kset_find_obj() to be thread-safe
using the proper model of refusing the get a new reference if the
refcount has already dropped to zero.

See examples of this proper refcount handling not only in the kref
documentation, but in various other equivalent uses of this pattern by
grepping for atomic_inc_not_zero().

[ Side note: the module race does indicate that module loading and
  unloading is not properly serialized wrt sysfs information using the
  module mutex.  That may require further thought, but this is the
  correct fix at the kobject layer regardless. ]

Reported-analyzed-and-tested-by: Anatol Pomozov <anatol.pomozov@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-16 21:27:27 -07:00
..
lzo
mpi MPI: Fix compilation on MIPS with GCC 4.4 and newer 2012-12-03 11:47:23 -08:00
raid6 Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
reed_solomon
xz
zlib_deflate
zlib_inflate
.gitignore
argv_split.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
atomic64.c lib: atomic64: Initialize locks statically to fix early users 2013-01-11 09:07:17 -08:00
atomic64_test.c bug.h: add include of it to various implicit C users 2012-02-29 17:15:08 -05:00
audit.c
average.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
bcd.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
bch.c
bitmap.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00
bitrev.c
bsearch.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
btree.c btree: fix tree corruption in btree_get_prev() 2012-06-17 11:21:22 -07:00
bug.c bugs, x86: Fix printk levels for panic, softlockups and stack dumps 2012-01-26 21:28:45 +01:00
bust_spinlocks.c
check_signature.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
checksum.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
clz_tab.c lib: Fix multiple definitions of clz_tab 2012-02-02 10:34:23 +11:00
cmdline.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
cordic.c Docs: wording: functions -> algorithm 2011-10-29 21:20:22 +02:00
cpu-notifier-error-inject.c
cpu_rmap.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
cpumask.c lib/cpumask.c: remove __any_online_cpu() 2012-03-28 17:14:35 -07:00
crc-ccitt.c
crc-itu-t.c
crc-t10dif.c
crc7.c
crc8.c
crc16.c
crc32.c crc32: add self-test code for crc32c 2012-03-23 16:58:38 -07:00
crc32defs.h crc32: select an algorithm via Kconfig 2012-03-23 16:58:38 -07:00
ctype.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
debug_locks.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
debugobjects.c debugobjects: Fix selftest for static warnings 2012-03-05 15:49:43 -08:00
dec_and_lock.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
decompress.c
decompress_bunzip2.c decompress_bunzip2: remove invalid vi modeline 2011-12-06 10:00:05 +01:00
decompress_inflate.c
decompress_unlzma.c treewide: Fix comment and string typo 'bufer' 2011-12-06 09:53:40 +01:00
decompress_unlzo.c unlzo: fix input buffer free 2012-01-12 20:13:13 -08:00
decompress_unxz.c
devres.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
digsig.c digsig: Fix memory leakage in digsig_verify_rsa() 2013-02-11 08:47:17 -08:00
div64.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
dma-debug.c Remove useless get_driver()/put_driver() calls 2012-01-24 16:00:35 -08:00
dump_stack.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
dynamic_debug.c dynamic_debug: process multiple debug-queries on a line 2012-01-24 12:50:36 -08:00
dynamic_queue_limits.c bql: Avoid possible inconsistent calculation. 2012-07-16 09:03:43 -07:00
extable.c
fault-inject.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
find_last_bit.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
find_next_bit.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
flex_array.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
gcd.c lib/gcd.c: prevent possible div by 0 2012-10-13 05:38:38 +09:00
gen_crc32table.c crc32: bolt on crc32c 2012-03-23 16:58:38 -07:00
genalloc.c genalloc: stop crashing the system when destroying a pool 2012-10-31 10:02:56 -07:00
halfmd4.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
hexdump.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
hweight.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
idr.c idr: fix a subtle bug in idr_get_next() 2013-03-04 06:06:40 +08:00
inflate.c
int_sqrt.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
iomap.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
iomap_copy.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
iommu-helper.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00
ioremap.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
irq_regs.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
is_single_threaded.c
kasprintf.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
Kconfig crc32: add help text for the algorithm select option 2012-03-28 17:14:37 -07:00
Kconfig.debug Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2012-03-29 14:28:26 -07:00
Kconfig.kgdb
Kconfig.kmemcheck
klist.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
kobject.c kobject: fix kset_find_obj() race with concurrent last kobject_put() 2013-04-16 21:27:27 -07:00
kobject_uevent.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00
kstrtox.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
kstrtox.h lib/kstrtox: common code between kstrto*() and simple_strto*() functions 2011-10-31 17:30:56 -07:00
lcm.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
libcrc32c.c
list_debug.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00
list_sort.c
llist.c Disintegrate and delete asm/system.h 2012-03-28 15:58:21 -07:00
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
lru_cache.c
Makefile lib: Fix multiple definitions of clz_tab 2012-02-02 10:34:23 +11:00
md5.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
nlattr.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
parser.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
pci_iomap.c lib: add NO_GENERIC_PCI_IOPORT_MAP 2012-01-31 23:19:47 +02:00
percpu_counter.c lib/percpu_counter.c: enclose hotplug only variables in hotplug ifdef 2011-10-31 17:30:56 -07:00
plist.c bug.h: add include of it to various implicit C users 2012-02-29 17:15:08 -05:00
prio_heap.c
prio_tree.c prio_tree: introduce prio_set_parent() 2012-03-23 16:58:36 -07:00
proportions.c
radix-tree.c radix-tree: fix contiguous iterator 2012-06-10 00:36:17 +09:00
random32.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
ratelimit.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
rational.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
rbtree.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
reciprocal_div.c sch_red: Adaptative RED AQM 2011-12-08 19:52:43 -05:00
rwsem-spinlock.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
rwsem.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
scatterlist.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00
sha1.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
show_mem.c
smp_processor_id.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
sort.c
spinlock_debug.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
string.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00
string_helpers.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
swiotlb.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00
syscall.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
test-kstrtox.c
textsearch.c
timerqueue.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00
ts_bm.c
ts_fsm.c
ts_kmp.c
uuid.c lib: reduce the use of module.h wherever possible 2012-03-07 15:04:04 -05:00
vsprintf.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00