From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932204AbcA3KX7 (ORCPT ); Sat, 30 Jan 2016 05:23:59 -0500 Received: from szxga03-in.huawei.com ([119.145.14.66]:9277 "EHLO szxga03-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753989AbcA3KX6 (ORCPT ); Sat, 30 Jan 2016 05:23:58 -0500 From: Weilong Chen To: , , Subject: [PATCH] Race between cat /proc/kallsyms and rmmod Date: Sat, 30 Jan 2016 18:23:36 +0800 Message-ID: <1454149416-105680-1-git-send-email-chenweilong@huawei.com> X-Mailer: git-send-email 2.5.0 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.175.101.78] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020206.56AC8F36.00B8,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-05-26 15:14:31, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: d24758cd7a274fa8ee35451a5f2b6702 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Iterating code of /proc/kallsyms calls module_get_kallsym() which grabs and drops module_mutex internally and returns "struct module *", module is removed, aforementioned "struct module *" is used in non-trivial way. So, grab module_mutex for entire operation like /proc/modules does. Steps to reproduce: while true; do modprobe xfs; rmmod xfs; done vs while true; do cat /proc/kallsyms >/dev/null; done ref:http://lkml.iu.edu/hypermail/linux/kernel/0703.1/2582.html https://bugzilla.kernel.org/show_bug.cgi?id=111541 Signed-off-by: Weilong Chen --- kernel/kallsyms.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c index 3127ad5..aaecf19 100644 --- a/kernel/kallsyms.c +++ b/kernel/kallsyms.c @@ -515,6 +515,7 @@ static void *s_next(struct seq_file *m, void *p, loff_t *pos) static void *s_start(struct seq_file *m, loff_t *pos) { + mutex_lock(&module_mutex); if (!update_iter(m->private, *pos)) return NULL; return m->private; @@ -522,6 +523,7 @@ static void *s_start(struct seq_file *m, loff_t *pos) static void s_stop(struct seq_file *m, void *p) { + mutex_unlock(&module_mutex); } static int s_show(struct seq_file *m, void *p) -- 1.8.3.1