From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B161C4167D for ; Sun, 12 Nov 2023 13:39:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232579AbjKLNjS (ORCPT ); Sun, 12 Nov 2023 08:39:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37366 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229441AbjKLNjH (ORCPT ); Sun, 12 Nov 2023 08:39:07 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5572449FD; Sun, 12 Nov 2023 05:28:54 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F3E1C433B9; Sun, 12 Nov 2023 13:28:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1699795734; bh=B99apPkptmEAgxM4fjDUZr7LS6pfTnPgy1UhO9CkiWk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DAoFgGVjRkdlLhbEx772AUq7TtGqyCXoGwrKJAJDX0x8R3geRQsXzFeRwqs4V4bvH x25WQIYEAk6cPczMIvhC4TuAKUDRG212ngNUiYExFxXJY+F4H+wTtOktOIdgS8DxCk HlvEObF3oTgViQJLuecTTG+CZUeX247Bn0jFq0GNDUIrTP1NdZxuXnSkcWybVruUeJ /MJKQfdHLa9MHSzHTAvzTWKxxf8pBMzs7lVsH06ZL773JTIjSsaJqeEQEUGwn2q7C+ TGLq9E7TKwD9oD163aNot/bQ12ayQQmMLbUs8Z0FN6OCSR8bkoAGwktNwQx96a15oC 2KfyZgAQrNtUg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Al Viro , Andreas Gruenbacher , Sasha Levin , swhiteho@redhat.com, rpeterso@redhat.com, cluster-devel@redhat.com Subject: [PATCH AUTOSEL 5.10 4/8] gfs2: fix an oops in gfs2_permission Date: Sun, 12 Nov 2023 08:28:42 -0500 Message-ID: <20231112132847.176473-4-sashal@kernel.org> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231112132847.176473-1-sashal@kernel.org> References: <20231112132847.176473-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 5.10.200 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Al Viro [ Upstream commit 0abd1557e21c617bd13fc18f7725fc6363c05913 ] In RCU mode, we might race with gfs2_evict_inode(), which zeroes ->i_gl. Freeing of the object it points to is RCU-delayed, so if we manage to fetch the pointer before it's been replaced with NULL, we are fine. Check if we'd fetched NULL and treat that as "bail out and tell the caller to get out of RCU mode". Signed-off-by: Al Viro Signed-off-by: Andreas Gruenbacher Signed-off-by: Sasha Levin --- fs/gfs2/inode.c | 11 +++++++++-- fs/gfs2/super.c | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c index 74a6b0800e059..963dc72e7155f 100644 --- a/fs/gfs2/inode.c +++ b/fs/gfs2/inode.c @@ -1837,14 +1837,21 @@ int gfs2_permission(struct inode *inode, int mask) { struct gfs2_inode *ip; struct gfs2_holder i_gh; + struct gfs2_glock *gl; int error; gfs2_holder_mark_uninitialized(&i_gh); ip = GFS2_I(inode); - if (gfs2_glock_is_locked_by_me(ip->i_gl) == NULL) { + gl = rcu_dereference(ip->i_gl); + if (unlikely(!gl)) { + /* inode is getting torn down, must be RCU mode */ + WARN_ON_ONCE(!(mask & MAY_NOT_BLOCK)); + return -ECHILD; + } + if (gfs2_glock_is_locked_by_me(gl) == NULL) { if (mask & MAY_NOT_BLOCK) return -ECHILD; - error = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh); + error = gfs2_glock_nq_init(gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh); if (error) return error; } diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c index b61de8dab51a0..8cf4ef61cdc41 100644 --- a/fs/gfs2/super.c +++ b/fs/gfs2/super.c @@ -1471,7 +1471,7 @@ static void gfs2_evict_inode(struct inode *inode) wait_on_bit_io(&ip->i_flags, GIF_GLOP_PENDING, TASK_UNINTERRUPTIBLE); gfs2_glock_add_to_lru(ip->i_gl); gfs2_glock_put_eventually(ip->i_gl); - ip->i_gl = NULL; + rcu_assign_pointer(ip->i_gl, NULL); } } -- 2.42.0