From 669420644c79c207f83fdf9105ae782867e2991f Mon Sep 17 00:00:00 2001 From: Alex Chiang Date: Fri, 13 Mar 2009 12:07:36 -0600 Subject: sysfs: only allow one scheduled removal callback per kobj The only way for a sysfs attribute to remove itself (without deadlock) is to use the sysfs_schedule_callback() interface. Vegard Nossum discovered that a poorly written sysfs ->store callback can repeatedly schedule remove callbacks on the same device over and over, e.g. $ while true ; do echo 1 > /sys/devices/.../remove ; done If the 'remove' attribute uses the sysfs_schedule_callback API and also does not protect itself from concurrent accesses, its callback handler will be called multiple times, and will eventually attempt to perform operations on a freed kobject, leading to many problems. Instead of requiring all callers of sysfs_schedule_callback to implement their own synchronization, provide the protection in the infrastructure. Now, sysfs_schedule_callback will only allow one scheduled callback per kobject. On subsequent calls with the same kobject, return -EAGAIN. This is a short term fix. The long term fix is to allow sysfs attributes to remove themselves directly, without any of this callback hokey pokey. [cornelia.huck@de.ibm.com: s390 ccwgroup bits] Reported-by: vegard.nossum@gmail.com Signed-off-by: Alex Chiang Acked-by: Cornelia Huck Signed-off-by: Greg Kroah-Hartman --- drivers/s390/cio/ccwgroup.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'drivers/s390/cio/ccwgroup.c') diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c index 918e6fce257..b91c1719b07 100644 --- a/drivers/s390/cio/ccwgroup.c +++ b/drivers/s390/cio/ccwgroup.c @@ -104,8 +104,9 @@ ccwgroup_ungroup_store(struct device *dev, struct device_attribute *attr, const rc = device_schedule_callback(dev, ccwgroup_ungroup_callback); out: if (rc) { - /* Release onoff "lock" when ungrouping failed. */ - atomic_set(&gdev->onoff, 0); + if (rc != -EAGAIN) + /* Release onoff "lock" when ungrouping failed. */ + atomic_set(&gdev->onoff, 0); return rc; } return count; -- cgit v1.2.3-70-g09d2 From 40c9f9992bc1caa1bb890bd8163361dbf2eefa86 Mon Sep 17 00:00:00 2001 From: Sebastian Ott Date: Thu, 26 Mar 2009 15:24:13 +0100 Subject: [S390] cio: ccw group online store - report rcs to the caller. In case the ccw group driver refuses to set a device [on|off]line, we should transmit the return code to the caller. Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky --- drivers/s390/cio/ccwgroup.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) (limited to 'drivers/s390/cio/ccwgroup.c') diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c index 918e6fce257..ec2742813bf 100644 --- a/drivers/s390/cio/ccwgroup.c +++ b/drivers/s390/cio/ccwgroup.c @@ -391,27 +391,28 @@ ccwgroup_online_store (struct device *dev, struct device_attribute *attr, const unsigned long value; int ret; - gdev = to_ccwgroupdev(dev); if (!dev->driver) - return count; + return -ENODEV; + + gdev = to_ccwgroupdev(dev); + gdrv = to_ccwgroupdrv(dev->driver); - gdrv = to_ccwgroupdrv (gdev->dev.driver); if (!try_module_get(gdrv->owner)) return -EINVAL; ret = strict_strtoul(buf, 0, &value); if (ret) goto out; - ret = count; + if (value == 1) - ccwgroup_set_online(gdev); + ret = ccwgroup_set_online(gdev); else if (value == 0) - ccwgroup_set_offline(gdev); + ret = ccwgroup_set_offline(gdev); else ret = -EINVAL; out: module_put(gdrv->owner); - return ret; + return (ret == 0) ? count : ret; } static ssize_t -- cgit v1.2.3-70-g09d2 From 50f1548399b7bd00ceb38c84a84463a89c82afe8 Mon Sep 17 00:00:00 2001 From: Sebastian Ott Date: Thu, 26 Mar 2009 15:24:14 +0100 Subject: [S390] cio: fix sanity checks in ccwgroup driver. Some sanity checks in the ccw group driver test the output of container_of macros to be !NULL. Test the input parameters instead. Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky --- drivers/s390/cio/ccwgroup.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) (limited to 'drivers/s390/cio/ccwgroup.c') diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c index ec2742813bf..2becedbe888 100644 --- a/drivers/s390/cio/ccwgroup.c +++ b/drivers/s390/cio/ccwgroup.c @@ -454,13 +454,17 @@ ccwgroup_remove (struct device *dev) struct ccwgroup_device *gdev; struct ccwgroup_driver *gdrv; + device_remove_file(dev, &dev_attr_online); + + if (!dev->driver) + return 0; + gdev = to_ccwgroupdev(dev); gdrv = to_ccwgroupdrv(dev->driver); - device_remove_file(dev, &dev_attr_online); - - if (gdrv && gdrv->remove) + if (gdrv->remove) gdrv->remove(gdev); + return 0; } @@ -469,9 +473,13 @@ static void ccwgroup_shutdown(struct device *dev) struct ccwgroup_device *gdev; struct ccwgroup_driver *gdrv; + if (!dev->driver) + return; + gdev = to_ccwgroupdev(dev); gdrv = to_ccwgroupdrv(dev->driver); - if (gdrv && gdrv->shutdown) + + if (gdrv->shutdown) gdrv->shutdown(gdev); } -- cgit v1.2.3-70-g09d2 From e909074bb91773680c0b2e49ea8af9f85c6f59bd Mon Sep 17 00:00:00 2001 From: Sebastian Ott Date: Thu, 26 Mar 2009 15:24:15 +0100 Subject: [S390] cio: ccw group fix unbind behaviour. For a ccw group device unbinding it from its driver should do the same as a call to ungroup, since this virtual device can not exist without a driver. Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky --- drivers/s390/cio/ccwgroup.c | 42 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 6 deletions(-) (limited to 'drivers/s390/cio/ccwgroup.c') diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c index 2becedbe888..86b136cb09e 100644 --- a/drivers/s390/cio/ccwgroup.c +++ b/drivers/s390/cio/ccwgroup.c @@ -314,16 +314,32 @@ error: } EXPORT_SYMBOL(ccwgroup_create_from_string); -static int __init -init_ccwgroup (void) +static int ccwgroup_notifier(struct notifier_block *nb, unsigned long action, + void *data); + +static struct notifier_block ccwgroup_nb = { + .notifier_call = ccwgroup_notifier +}; + +static int __init init_ccwgroup(void) { - return bus_register (&ccwgroup_bus_type); + int ret; + + ret = bus_register(&ccwgroup_bus_type); + if (ret) + return ret; + + ret = bus_register_notifier(&ccwgroup_bus_type, &ccwgroup_nb); + if (ret) + bus_unregister(&ccwgroup_bus_type); + + return ret; } -static void __exit -cleanup_ccwgroup (void) +static void __exit cleanup_ccwgroup(void) { - bus_unregister (&ccwgroup_bus_type); + bus_unregister_notifier(&ccwgroup_bus_type, &ccwgroup_nb); + bus_unregister(&ccwgroup_bus_type); } module_init(init_ccwgroup); @@ -455,6 +471,7 @@ ccwgroup_remove (struct device *dev) struct ccwgroup_driver *gdrv; device_remove_file(dev, &dev_attr_online); + device_remove_file(dev, &dev_attr_ungroup); if (!dev->driver) return 0; @@ -492,6 +509,19 @@ static struct bus_type ccwgroup_bus_type = { .shutdown = ccwgroup_shutdown, }; + +static int ccwgroup_notifier(struct notifier_block *nb, unsigned long action, + void *data) +{ + struct device *dev = data; + + if (action == BUS_NOTIFY_UNBIND_DRIVER) + device_schedule_callback(dev, ccwgroup_ungroup_callback); + + return NOTIFY_OK; +} + + /** * ccwgroup_driver_register() - register a ccw group driver * @cdriver: driver to be registered -- cgit v1.2.3-70-g09d2