[Cluster-devel] [DLM] keep dlm from panicing when traversing rsb list in debugfs

[Cluster-devel] [DLM] keep dlm from panicing when traversing rsb list in debugfs

[Josef Bacik]

Hello,

This problem was originally reported against GFS6.1, but the same issue exists
in upstream DLM.  This patch keeps the rsb iterator assigning under the rsbtbl
list lock.  Each time we process an rsb we grab a reference to it to make sure
it is not freed out from underneath us, and then put it when we get the next rsb
in the list or move onto another list.  Thank you,

Josef


Signed-off-by: Josef Bacik <jwhiter@redhat.com>

diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c
index 61ba670..9e27a16 100644
--- a/fs/dlm/debug_fs.c
+++ b/fs/dlm/debug_fs.c
@@ -17,6 +17,7 @@
 #include <linux/debugfs.h>
 
 #include "dlm_internal.h"
+#include "lock.h"
 
 #define DLM_DEBUG_BUF_LEN 4096
 static char debug_buf[DLM_DEBUG_BUF_LEN];
@@ -166,6 +167,9 @@ static int rsb_iter_next(struct rsb_iter
 			read_lock(&ls->ls_rsbtbl[i].lock);
 			if (!list_empty(&ls->ls_rsbtbl[i].list)) {
 				ri->next = ls->ls_rsbtbl[i].list.next;
+				ri->rsb = list_entry(ri->next, struct dlm_rsb,
+							res_hashchain);
+				dlm_hold_rsb(ri->rsb);
 				read_unlock(&ls->ls_rsbtbl[i].lock);
 				break;
 			}
@@ -176,6 +180,7 @@ static int rsb_iter_next(struct rsb_iter
 		if (ri->entry >= ls->ls_rsbtbl_size)
 			return 1;
 	} else {
+		struct dlm_rsb *old = ri->rsb;
 		i = ri->entry;
 		read_lock(&ls->ls_rsbtbl[i].lock);
 		ri->next = ri->next->next;
@@ -184,11 +189,13 @@ static int rsb_iter_next(struct rsb_iter
 			ri->next = NULL;
 			ri->entry++;
 			read_unlock(&ls->ls_rsbtbl[i].lock);
+			dlm_put_rsb(old);
 			goto top;
                 }
+		ri->rsb = list_entry(ri->next, struct dlm_rsb, res_hashchain);
 		read_unlock(&ls->ls_rsbtbl[i].lock);
+		dlm_put_rsb(old);
 	}
-	ri->rsb = list_entry(ri->next, struct dlm_rsb, res_hashchain);
 
 	return 0;
 }

[Cluster-devel] [DLM] keep dlm from panicing when traversing rsb list in debugfs

[Steven Whitehouse]

Hi,

Applied to the -nmw git tree. Thanks,

Steve.

On Wed, 2007-05-16 at 15:56 -0400, Josef Bacik wrote:
> Hello,
> 
> This problem was originally reported against GFS6.1, but the same issue exists
> in upstream DLM.  This patch keeps the rsb iterator assigning under the rsbtbl
> list lock.  Each time we process an rsb we grab a reference to it to make sure
> it is not freed out from underneath us, and then put it when we get the next rsb
> in the list or move onto another list.  Thank you,
> 
> Josef
> 
> 
> Signed-off-by: Josef Bacik <jwhiter@redhat.com>
> 
> diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c
> index 61ba670..9e27a16 100644
> --- a/fs/dlm/debug_fs.c
> +++ b/fs/dlm/debug_fs.c
> @@ -17,6 +17,7 @@
>  #include <linux/debugfs.h>
>  
>  #include "dlm_internal.h"
> +#include "lock.h"
>  
>  #define DLM_DEBUG_BUF_LEN 4096
>  static char debug_buf[DLM_DEBUG_BUF_LEN];
> @@ -166,6 +167,9 @@ static int rsb_iter_next(struct rsb_iter
>  			read_lock(&ls->ls_rsbtbl[i].lock);
>  			if (!list_empty(&ls->ls_rsbtbl[i].list)) {
>  				ri->next = ls->ls_rsbtbl[i].list.next;
> +				ri->rsb = list_entry(ri->next, struct dlm_rsb,
> +							res_hashchain);
> +				dlm_hold_rsb(ri->rsb);
>  				read_unlock(&ls->ls_rsbtbl[i].lock);
>  				break;
>  			}
> @@ -176,6 +180,7 @@ static int rsb_iter_next(struct rsb_iter
>  		if (ri->entry >= ls->ls_rsbtbl_size)
>  			return 1;
>  	} else {
> +		struct dlm_rsb *old = ri->rsb;
>  		i = ri->entry;
>  		read_lock(&ls->ls_rsbtbl[i].lock);
>  		ri->next = ri->next->next;
> @@ -184,11 +189,13 @@ static int rsb_iter_next(struct rsb_iter
>  			ri->next = NULL;
>  			ri->entry++;
>  			read_unlock(&ls->ls_rsbtbl[i].lock);
> +			dlm_put_rsb(old);
>  			goto top;
>                  }
> +		ri->rsb = list_entry(ri->next, struct dlm_rsb, res_hashchain);
>  		read_unlock(&ls->ls_rsbtbl[i].lock);
> +		dlm_put_rsb(old);
>  	}
> -	ri->rsb = list_entry(ri->next, struct dlm_rsb, res_hashchain);
>  
>  	return 0;
>  }
>