[PATCH] md: use READ_ONCE() for rdev_attr_show() mddev check
Runyu Xiao <[email protected]>
| Newsgroups | gmane.linux.raid,gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
md_kick_rdev_from_array() clears rdev->mddev with
WRITE_ONCE(rdev->mddev, NULL), and rdev_attr_store() already snapshots
that same shared pointer with READ_ONCE(rdev->mddev). rdev_attr_show()
still tests the pointer with a plain lockless `if (!rdev->mddev)` before
calling entry->show().
A running system can reach this by reading rdev sysfs attributes while a
device removal path is tearing the same md_rdev down. In that window,
rdev_attr_show() can pass a stale plain guard while sibling
rdev_attr_store() already observes NULL and returns -ENODEV, leaving the
show path to operate after the shared mddev pointer has been revoked.
Use READ_ONCE() in rdev_attr_show() so this sysfs read side matches the
existing visibility contract on rdev->mddev.
Fixes: 9cfcf99e7ed6 ("md: get rdev->mddev with READ_ONCE()")
Signed-off-by: Runyu Xiao <[email protected]>
---
drivers/md/md.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 92ec4be20db8..a021cf4a798d 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3704,7 +3704,7 @@ rdev_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
if (!entry->show)
return -EIO;
- if (!rdev->mddev)
+ if (!READ_ONCE(rdev->mddev))
return -ENODEV;
return entry->show(rdev, page);
}
--
2.34.1