Fix blk{back,tap} sysfs race

Read blk{back,tap} statistics info after remove vbd device(s) kernel
will crash.

Signed-off-by: Joe Jin <joe.jin@oracle.com>
Acked-by: Jan Beulich <jbeulich@novell.com>

diff --git a/drivers/xen/blkback/xenbus.c b/drivers/xen/blkback/xenbus.c
index 7e689c758117f299dc4969924ac8270168577b2e..6a5669e9292b60e1d2fa1de7a6db9153010e9329 100644 (file)
--- a/drivers/xen/blkback/xenbus.c
+++ b/drivers/xen/blkback/xenbus.c
@@ -27,6 +27,8 @@
        pr_debug("blkback/xenbus (%s:%d) " fmt ".\n",   \
                 __FUNCTION__, __LINE__, ##args)
 
+static DEFINE_RWLOCK(sysfs_read_lock);
+
 struct backend_info
 {
        struct xenbus_device *dev;
@@ -104,10 +106,19 @@ static void update_blkif_status(blkif_t *blkif)
                                   struct device_attribute *attr,       \
                                   char *buf)                           \
        {                                                               \
-               struct xenbus_device *dev = to_xenbus_device(_dev);     \
-               struct backend_info *be = dev->dev.driver_data;         \
+               ssize_t ret = -ENODEV;                                  \
+               struct xenbus_device *dev;                              \
+               struct backend_info *be;                                \
                                                                        \
-               return sprintf(buf, format, ##args);                    \
+               if (!get_device(_dev))                                  \
+                       return ret;                                     \
+               dev = to_xenbus_device(_dev);                           \
+               read_lock(&sysfs_read_lock);                            \
+               if ((be = dev->dev.driver_data) != NULL)                \
+                       ret = sprintf(buf, format, ##args);             \
+               read_unlock(&sysfs_read_lock);                          \
+               put_device(_dev);                                       \
+               return ret;                                             \
        }                                                               \
        static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL)
 
@@ -173,6 +184,7 @@ static int blkback_remove(struct xenbus_device *dev)
 
        DPRINTK("");
 
+       write_lock(&sysfs_read_lock);
        if (be->major || be->minor)
                xenvbd_sysfs_delif(dev);
 
@@ -191,6 +203,7 @@ static int blkback_remove(struct xenbus_device *dev)
 
        kfree(be);
        dev->dev.driver_data = NULL;
+       write_unlock(&sysfs_read_lock);
        return 0;
 }
 

diff --git a/drivers/xen/blktap/xenbus.c b/drivers/xen/blktap/xenbus.c
index 64534726b3358d31568a1eb21f520ebc37797ac6..86965d896c46804184fbecf12828144bb5444f57 100644 (file)
--- a/drivers/xen/blktap/xenbus.c
+++ b/drivers/xen/blktap/xenbus.c
@@ -50,6 +50,7 @@ struct backend_info
        int group_added;
 };
 
+static DEFINE_RWLOCK(sysfs_read_lock);
 
 static void connect(struct backend_info *);
 static int connect_ring(struct backend_info *);
@@ -122,10 +123,19 @@ static int blktap_name(blkif_t *blkif, char *buf)
                                   struct device_attribute *attr,       \
                                   char *buf)                           \
        {                                                               \
-               struct xenbus_device *dev = to_xenbus_device(_dev);     \
-               struct backend_info *be = dev->dev.driver_data;         \
+               ssize_t ret = -ENODEV;                                  \
+               struct xenbus_device *dev;                              \
+               struct backend_info *be;                                \
                                                                        \
-               return sprintf(buf, format, ##args);                    \
+               if (!get_device(_dev))                                  \
+                       return ret;                                     \
+               dev = to_xenbus_device(_dev);                           \
+               read_lock(&sysfs_read_lock);                            \
+               if ((be = dev->dev.driver_data) != NULL)                \
+                       ret = sprintf(buf, format, ##args);             \
+               read_unlock(&sysfs_read_lock);                          \
+               put_device(_dev);                                       \
+               return ret;                                             \
        }                                                               \
        static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL)
 
@@ -170,6 +180,7 @@ static int blktap_remove(struct xenbus_device *dev)
 {
        struct backend_info *be = dev->dev.driver_data;
 
+       write_lock(&sysfs_read_lock);
        if (be->group_added)
                xentap_sysfs_delif(be->dev);
        if (be->backend_watch.node) {
@@ -187,6 +198,7 @@ static int blktap_remove(struct xenbus_device *dev)
        }
        kfree(be);
        dev->dev.driver_data = NULL;
+       write_unlock(&sysfs_read_lock);
        return 0;
 }