diff options
| author | Hannes Reinecke <hare@suse.de> | 2020-02-13 16:32:06 +0100 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2020-02-24 14:54:25 -0500 |
| commit | 1c7ce4bcfb9a54073d4043c00a336a064ca6e231 (patch) | |
| tree | 5bdfe2a328f90da7cfd7de9a032d5b14c66f52cb /drivers/scsi/ch.c | |
| parent | 66167283c21ef8ce35253397108263bdab258992 (diff) | |
| download | linux-1c7ce4bcfb9a54073d4043c00a336a064ca6e231.tar.bz2 | |
scsi: ch: synchronize ch_probe() and ch_open()
The 'ch' device node is created before the configuration is being read in,
which leads to a race window when ch_open() is called before that.
To avoid any races we should be taking the device mutex during
ch_readconfig() and ch_init_elem(), and also during ch_open().
That ensures ch_probe is finished before ch_open() completes.
Link: https://lore.kernel.org/r/20200213153207.123357-3-hare@suse.de
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/ch.c')
| -rw-r--r-- | drivers/scsi/ch.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c index e3a006d194e0..7fdb636339e4 100644 --- a/drivers/scsi/ch.c +++ b/drivers/scsi/ch.c @@ -606,7 +606,10 @@ ch_open(struct inode *inode, struct file *file) mutex_unlock(&ch_mutex); return -ENXIO; } + /* Synchronize with ch_probe() */ + mutex_lock(&ch->lock); file->private_data = ch; + mutex_unlock(&ch->lock); mutex_unlock(&ch_mutex); return 0; } @@ -949,6 +952,9 @@ static int ch_probe(struct device *dev) goto remove_idr; } + mutex_init(&ch->lock); + kref_init(&ch->ref); + ch->device = sd; class_dev = device_create(ch_sysfs_class, dev, MKDEV(SCSI_CHANGER_MAJOR, ch->minor), ch, "s%s", ch->name); @@ -959,15 +965,16 @@ static int ch_probe(struct device *dev) goto put_device; } - mutex_init(&ch->lock); - kref_init(&ch->ref); - ch->device = sd; + mutex_lock(&ch->lock); ret = ch_readconfig(ch); - if (ret) + if (ret) { + mutex_unlock(&ch->lock); goto destroy_dev; + } if (init) ch_init_elem(ch); + mutex_unlock(&ch->lock); dev_set_drvdata(dev, ch); sdev_printk(KERN_INFO, sd, "Attached scsi changer %s\n", ch->name); |