mdstat_poll() sleeps the poller on md_event_waiters and md_exit() has to wake it in a loop until nobody is left on the queue, because the queue goes away with the module. procfs owns the queue poll() uses now, it outlives the module, and a poll of the removed entry reports EPOLLERR | EPOLLPRI, so md_new_event() wakes the pollers through proc_poll_notify() and the loop and md_unloading go.
md_exit() removes /proc/mdstat last now. A sysfs store on an inactive array doesn't hold the module, so it can still reach md_new_event() while md_exit() runs, until destroy_workqueue() has waited for the last array to go, and a wake-up through a removed entry is a use after free. The static queue didn't mind that, the entry does. Signed-off-by: Christian Brauner (Amutable) <[email protected]> --- drivers/md/md.c | 29 ++++++++--------------------- 1 file changed, 8 insertions(+), 21 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 64abf1743e41..7560dcf0f5c8 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -351,12 +351,12 @@ static bool check_new_feature = true; * start array, stop array, error, add device, remove device, * start build, activate spare */ -static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters); +static struct proc_dir_entry *mdstat_entry; static atomic_t md_event_count; void md_new_event(void) { atomic_inc(&md_event_count); - wake_up(&md_event_waiters); + proc_poll_notify(mdstat_entry); } EXPORT_SYMBOL_GPL(md_new_event); @@ -9176,16 +9176,11 @@ static int md_seq_open(struct inode *inode, struct file *file) return 0; } -static int md_unloading; static __poll_t mdstat_poll(struct file *filp, poll_table *wait) { struct seq_file *seq = filp->private_data; __poll_t mask; - if (md_unloading) - return EPOLLIN|EPOLLRDNORM|EPOLLERR|EPOLLPRI; - poll_wait(filp, &md_event_waiters, wait); - /* always allow read */ mask = EPOLLIN | EPOLLRDNORM; @@ -10765,7 +10760,7 @@ static void md_geninit(void) { pr_debug("md: sizeof(mdp_super_t) = %d\n", (int)sizeof(mdp_super_t)); - proc_create("mdstat", S_IRUGO, NULL, &mdstat_proc_ops); + mdstat_entry = proc_create("mdstat", S_IRUGO, NULL, &mdstat_proc_ops); } static int __init md_init(void) @@ -11074,25 +11069,12 @@ void md_autostart_arrays(int part) static __exit void md_exit(void) { struct mddev *mddev; - int delay = 1; unregister_blkdev(MD_MAJOR,"md"); unregister_blkdev(mdp_major, "mdp"); unregister_reboot_notifier(&md_notifier); unregister_sysctl_table(raid_table_header); - /* We cannot unload the modules while some process is - * waiting for us in select() or poll() - wake them up - */ - md_unloading = 1; - while (waitqueue_active(&md_event_waiters)) { - /* not safe to leave yet */ - wake_up(&md_event_waiters); - msleep(delay); - delay += delay; - } - remove_proc_entry("mdstat", NULL); - spin_lock(&all_mddevs_lock); list_for_each_entry(mddev, &all_mddevs, all_mddevs) { if (!mddev_get(mddev)) @@ -11112,6 +11094,11 @@ static __exit void md_exit(void) spin_unlock(&all_mddevs_lock); destroy_workqueue(md_misc_wq); + /* + * Only now can nothing reach md_new_event() anymore, which wakes the + * pollers of /proc/mdstat through its entry. + */ + remove_proc_entry("mdstat", NULL); md_bitmap_exit(); } -- 2.53.0
