linux/drivers
Takashi Iwai 529e71e164 zram: fix unbalanced idr management at hot removal
The zram hot removal code calls idr_remove() even when zram_remove()
returns an error (typically -EBUSY).  This results in a leftover at the
device release, eventually leading to a crash when the module is
reloaded.

As described in the bug report below, the following procedure would
cause an Oops with zram:

 - provision three zram devices via modprobe zram num_devices=3
 - configure a size for each device
   + echo "1G" > /sys/block/$zram_name/disksize
 - mkfs and mount zram0 only
 - attempt to hot remove all three devices
   + echo 2 > /sys/class/zram-control/hot_remove
   + echo 1 > /sys/class/zram-control/hot_remove
   + echo 0 > /sys/class/zram-control/hot_remove
     - zram0 removal fails with EBUSY, as expected
 - unmount zram0
 - try zram0 hot remove again
   + echo 0 > /sys/class/zram-control/hot_remove
     - fails with ENODEV (unexpected)
 - unload zram kernel module
   + completes successfully
 - zram0 device node still exists
 - attempt to mount /dev/zram0
   + mount command is killed
   + following BUG is encountered

 BUG: unable to handle kernel paging request at ffffffffa0002ba0
 IP: get_disk+0x16/0x50
 Oops: 0000 [#1] SMP
 CPU: 0 PID: 252 Comm: mount Not tainted 4.9.0-rc6 #176
 Call Trace:
   exact_lock+0xc/0x20
   kobj_lookup+0xdc/0x160
   get_gendisk+0x2f/0x110
   __blkdev_get+0x10c/0x3c0
   blkdev_get+0x19d/0x2e0
   blkdev_open+0x56/0x70
   do_dentry_open.isra.19+0x1ff/0x310
   vfs_open+0x43/0x60
   path_openat+0x2c9/0xf30
   do_filp_open+0x79/0xd0
   do_sys_open+0x114/0x1e0
   SyS_open+0x19/0x20
   entry_SYSCALL_64_fastpath+0x13/0x94

This patch adds the proper error check in hot_remove_store() not to call
idr_remove() unconditionally.

Fixes: 17ec4cd985 ("zram: don't call idr_remove() from zram_remove()")
Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1010970
Link: http://lkml.kernel.org/r/20161121132140.12683-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: David Disseldorp <ddiss@suse.de>
Reported-by: David Disseldorp <ddiss@suse.de>
Tested-by: David Disseldorp <ddiss@suse.de>
Acked-by: Minchan Kim <minchan@kernel.org>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: <stable@vger.kernel.org>    [4.4+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-11-30 16:32:52 -08:00
..
accessibility
acpi Merge branches 'acpi-sleep-fixes' and 'acpi-wdat-fixes' 2016-11-25 22:24:07 +01:00
amba
android ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct 2016-10-24 19:37:48 +02:00
ata ahci: always fall back to single-MSI mode 2016-11-21 11:06:57 -05:00
atm
auxdisplay auxdisplay: img-ascii-lcd: driver for simple ASCII LCD displays 2016-10-06 17:03:41 +02:00
base driver core fixes for 4.9-rc5 2016-11-13 10:22:07 -08:00
bcma
block zram: fix unbalanced idr management at hot removal 2016-11-30 16:32:52 -08:00
bluetooth Bluetooth: btwilink: Fix probe return value 2016-10-20 10:14:49 +02:00
bus bus: qcom-ebi2: depend on ARCH_QCOM or COMPILE_TEST 2016-10-17 13:46:09 -07:00
cdrom
char ipmi/bt-bmc: change compatible node to 'aspeed, ast2400-ibt-bmc' 2016-11-17 16:31:09 -08:00
clk Allwinner clock fixes for 4.9 2016-11-16 11:10:58 -08:00
clocksource Revert "clocksource/drivers/timer_sun5i: Replace code by clocksource_mmio_init" 2016-10-20 21:58:58 +02:00
connector
cpufreq Merge branches 'pm-cpufreq-fixes' and 'pm-sleep-fixes' 2016-10-29 01:29:17 +02:00
cpuidle Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2016-10-15 09:26:12 -07:00
crypto crypto: caam - fix type mismatch warning 2016-11-17 22:14:21 +08:00
dax device-dax: fail all private mapping attempts 2016-11-16 09:00:38 -08:00
dca
devfreq PM / devfreq: Skip status update on uninitialized previous_freq 2016-10-11 00:01:20 +02:00
dio
dma dmaengine: cppi41: More PM runtime fixes 2016-11-17 16:09:23 +05:30
dma-buf Merge tag 'drm-for-v4.9' of git://people.freedesktop.org/~airlied/linux 2016-10-11 18:12:22 -07:00
edac * Altera Arria10 enablement of NAND, DMA, USB, QSPI and SD-MMC FIFO 2016-10-04 12:06:26 -07:00
eisa
extcon extcon: qcom-spmi-misc: Sync the extcon state on interrupt 2016-10-26 16:04:29 +09:00
firewire firewire: net: fix fragmented datagram_size off-by-one 2016-11-03 14:46:39 +01:00
firmware efi/arm: Fix absolute relocation detection for older toolchains 2016-10-19 14:49:44 +02:00
fmc
fpga
gpio gpio: Remove GPIO_DEVRES option 2016-11-16 20:46:32 +01:00
gpu Merge branch 'mediatek-drm-fixes-2016-11-24' of https://github.com/ckhu-mediatek/linux.git-tags into drm-fixes 2016-11-25 14:21:26 +10:00
hid HID: hid-sensor-hub: clear memory to avoid random data 2016-11-23 17:54:58 +01:00
hsi
hv vmbus: make sysfs names consistent with PCI 2016-11-01 09:07:13 -06:00
hwmon hwmon: (core) fix resource leak on devm_kcalloc failure 2016-10-24 06:05:13 -07:00
hwspinlock
hwtracing
i2c Revert "i2c: designware: do not disable adapter after transfer" 2016-11-25 23:23:25 +01:00
ide
idle nmi_backtrace: generate one-line reports for idle cpus 2016-10-07 18:46:30 -07:00
iio iio: maxim_thermocouple: detect invalid storage size in read() 2016-11-13 10:08:32 +01:00
infiniband First round of -rc fixes 2016-11-17 13:53:02 -08:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2016-11-05 11:26:11 -07:00
iommu Merge git://git.infradead.org/intel-iommu 2016-11-27 08:24:46 -08:00
ipack ipack: print a hex number after a 0x prefix 2016-10-27 18:43:43 -07:00
irqchip GIC updates for Linux 4.9-rc2 2016-10-21 21:40:29 +02:00
isdn
leds
lguest
lightnvm Merge branch 'for-4.9/block' of git://git.kernel.dk/linux-block 2016-10-07 14:42:05 -07:00
macintosh
mailbox mailbox: PCC: Fix lockdep warning when request PCC channel 2016-11-14 22:07:38 +01:00
mcb mcb: Add a dma_device to mcb_device 2016-09-27 12:33:47 +02:00
md Merge tag 'md/4.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md 2016-11-05 11:34:07 -07:00
media xc2028: Fix use-after-free bug properly 2016-11-23 21:04:26 -02:00
memory ARM: SoC driver updates for v4.9 2016-10-07 21:23:40 -07:00
memstick memstick: rtsx_usb_ms: Manage runtime PM when accessing the device 2016-10-17 15:43:05 +02:00
message
mfd mfd: wm8994-core: Don't use managed regulator bulk get API 2016-11-25 11:10:55 +00:00
misc mei: bus: fix received data size check in NFC fixup 2016-10-31 10:25:22 -06:00
mmc mmc: dw_mmc: fix the error handling for dma operation 2016-11-21 11:08:28 +01:00
mtd MTD updates for 4.9-rc4: 2016-11-05 10:52:29 -07:00
net mvpp2: use correct size for memset 2016-11-25 20:57:21 -05:00
nfc mei: bus: fix received data size check in NFC fixup 2016-10-31 10:25:22 -06:00
ntb ntb_perf: potential info leak in debugfs 2016-11-13 16:48:30 -05:00
nubus
nvdimm nvdimm: make CONFIG_NVDIMM_DAX 'bool' 2016-10-27 16:16:21 -07:00
nvme nvme/pci: Don't free queues on error 2016-11-16 12:39:57 -07:00
nvmem ARM: SoC driver updates for v4.9 2016-10-07 21:23:40 -07:00
of of_mdio: fix device reference leak in of_phy_find_device 2016-11-17 12:05:04 -05:00
oprofile Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-10 20:16:43 -07:00
parisc
parport
pci Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-11-14 08:39:56 -08:00
pcmcia pcmcia: fix return value of soc_pcmcia_regulator_set 2016-11-11 08:45:08 -08:00
perf perf: xgene: Remove bogus IS_ERR() check 2016-10-17 15:50:07 +01:00
phy phy: twl4030-usb: Fix for musb session bit based PM 2016-11-17 16:25:40 +01:00
pinctrl pinctrl-aspeed-g5: Never set SCU90[6] 2016-11-07 10:31:33 +01:00
platform ACPI fix for v4.9-rc5 2016-11-11 17:02:01 -08:00
pnp
power power supply and reset changes for the v4.9 series 2016-10-06 18:21:15 -07:00
powercap
pps pps: kc: fix non-tickless system config dependency 2016-10-11 15:06:32 -07:00
ps3
ptp drivers/ptp: Fix kernel memory disclosure 2016-10-13 10:20:06 -04:00
pwm
rapidio mm: replace get_user_pages() write/force parameters with gup_flags 2016-10-19 08:11:43 -07:00
ras
regulator regulator: core: silence warning: "VDD1: ramp_delay not set" 2016-10-28 18:22:40 +01:00
remoteproc rpmsg updates for v4.9 2016-10-06 17:03:49 -07:00
reset reset: uniphier: rename MIO reset to SD reset for Pro5, PXs2, LD20 SoCs 2016-10-22 18:31:42 +09:00
rpmsg
rtc rtc: omap: prevent disabling of clock/module during suspend 2016-11-04 23:11:39 +01:00
s390 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2016-10-27 14:16:30 -07:00
sbus
scsi SCSI fixes on 20161129 2016-11-29 11:15:37 -08:00
sfi
sh
sn
soc powerpc updates for 4.9 #2 2016-10-14 11:07:42 -07:00
spi Merge remote-tracking branches 'spi/fix/dt', 'spi/fix/fsl-dspi' and 'spi/fix/fsl-espi' into spi-linus 2016-10-29 12:51:55 -06:00
spmi spmi: pmic-arb: Return an error code if sanity check fails 2016-09-27 12:43:34 +02:00
ssb
staging Staging/IIO fixes for 4.9-rc5 2016-11-13 10:13:33 -08:00
target target/tcm_fc: use CPU affinity for responses 2016-10-21 01:19:44 -07:00
tc
thermal thermal/powerclamp: add back module device table 2016-11-21 20:54:40 +08:00
thunderbolt
tty tty: serial_core: fix NULL struct tty pointer access in uart_write_wakeup 2016-10-28 08:13:07 -04:00
uio
usb USB-serial fixes for v4.9-rc6 2016-11-18 15:49:31 +01:00
uwb uwb: fix device reference leaks 2016-11-01 09:04:04 -06:00
vfio vfio/pci: Fix integer overflows, bitmask check 2016-10-26 13:49:29 -06:00
vhost
video video: ARM CLCD: fix Vexpress regression 2016-11-03 12:20:14 +02:00
virt mm: replace get_user_pages() write/force parameters with gup_flags 2016-10-19 08:11:43 -07:00
virtio virtio_ring: mark vring_dma_dev inline 2016-10-31 00:40:08 +02:00
vlynq
vme vme: vme_get_size potentially returning incorrect value on failure 2016-10-28 08:25:18 -04:00
w1
watchdog Merge branches 'acpi-sleep-fixes' and 'acpi-wdat-fixes' 2016-11-25 22:24:07 +01:00
xen xen: fixes for 4.9-rc2 2016-10-24 19:52:24 -07:00
zorro
Kconfig
Makefile A small bug fix and a new driver for acting as an IPMI device. 2016-10-23 15:56:23 -07:00