From: Al Viro <viro@ZenIV.linux.org.uk>
To: Neil Brown <neilb@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>,
linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 002 of 6] md: Fix use-after-free bug when dropping an rdev from an md array.
Date: Mon, 14 Jan 2008 13:56:18 +0000 [thread overview]
Message-ID: <20080114135618.GQ27894@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20080114125939.GP27894@ZenIV.linux.org.uk>
On Mon, Jan 14, 2008 at 12:59:39PM +0000, Al Viro wrote:
> I really don't like the entire scheme, to be honest. BTW, what happens
> if you try to add the same device to the same array after having it kicked
> out? If that comes before your delayed kobject_del(), the things will
> get nasty since sysfs will (rightfully) refuse to add another entry with
> the same name and parent while the old one is still there and for all
> sysfs knows is going to stay there...
More fun questions: what are the locking requirements for ->resize()?
You are calling it with no exclusion whatsoever... What about
bind_rdev_to_array()? At the very least, you want to protect
mddev->disks, and AFAICS new_dev_store() has no exclusion at all.
And I suspect that you have other things in there in need of protection
(finding free desc_nr, for one); can all of those be handled by simple
spinlocks?
next prev parent reply other threads:[~2008-01-14 13:56 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-01-14 1:45 [PATCH 000 of 6] md: various fixes for md NeilBrown
2008-01-14 1:45 ` NeilBrown
2008-01-14 1:45 ` [PATCH 001 of 6] md: Fix an occasional deadlock in raid5 NeilBrown
2008-01-14 1:45 ` NeilBrown
2008-01-16 5:01 ` dean gaudet
2008-01-16 5:54 ` Andrew Morton
2008-01-16 6:13 ` dean gaudet
2008-01-16 7:09 ` Dan Williams
2008-01-16 7:15 ` Andrew Morton
2008-01-16 21:54 ` Neil Brown
2008-01-14 1:45 ` [PATCH 002 of 6] md: Fix use-after-free bug when dropping an rdev from an md array NeilBrown
2008-01-14 1:45 ` NeilBrown
2008-01-14 2:04 ` Al Viro
2008-01-14 3:21 ` Neil Brown
2008-01-14 3:43 ` Al Viro
2008-01-14 4:48 ` Neil Brown
2008-01-14 6:28 ` Neil Brown
2008-01-14 12:59 ` Al Viro
2008-01-14 13:56 ` Al Viro [this message]
2008-01-14 1:45 ` [PATCH 003 of 6] md: Change a few 'int' to 'size_t' in md NeilBrown
2008-01-14 1:45 ` [PATCH 004 of 6] md: Change INTERATE_MDDEV to for_each_mddev NeilBrown
2008-01-14 1:45 ` [PATCH 005 of 6] md: Change ITERATE_RDEV to rdev_for_each NeilBrown
2008-01-14 1:45 ` [PATCH 006 of 6] md: Change ITERATE_RDEV_GENERIC to rdev_for_each_list, and remove ITERATE_RDEV_PENDING NeilBrown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080114135618.GQ27894@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-raid@vger.kernel.org \
--cc=neilb@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.