public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Bob Peterson <rpeterso@redhat.com>,
	syzbot+c6fd14145e2f62ca0784@syzkaller.appspotmail.com,
	Andreas Gruenbacher <agruenba@redhat.com>,
	Sasha Levin <sashal@kernel.org>,
	cluster-devel@redhat.com
Subject: [PATCH AUTOSEL 5.15 01/27] gfs2: assign rgrp glock before compute_bitstructs
Date: Wed,  6 Apr 2022 21:12:31 -0400	[thread overview]
Message-ID: <20220407011257.114287-1-sashal@kernel.org> (raw)

From: Bob Peterson <rpeterso@redhat.com>

[ Upstream commit 428f651cb80b227af47fc302e4931791f2fb4741 ]

Before this patch, function read_rindex_entry called compute_bitstructs
before it allocated a glock for the rgrp. But if compute_bitstructs found
a problem with the rgrp, it called gfs2_consist_rgrpd, and that called
gfs2_dump_glock for rgd->rd_gl which had not yet been assigned.

read_rindex_entry
   compute_bitstructs
      gfs2_consist_rgrpd
         gfs2_dump_glock <---------rgd->rd_gl was not set.

This patch changes read_rindex_entry so it assigns an rgrp glock before
calling compute_bitstructs so gfs2_dump_glock does not reference an
unassigned pointer. If an error is discovered, the glock must also be
put, so a new goto and label were added.

Reported-by: syzbot+c6fd14145e2f62ca0784@syzkaller.appspotmail.com
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/rgrp.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index c3b00ba92ed2..e21f8e10d70b 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -922,15 +922,15 @@ static int read_rindex_entry(struct gfs2_inode *ip)
 	spin_lock_init(&rgd->rd_rsspin);
 	mutex_init(&rgd->rd_mutex);
 
-	error = compute_bitstructs(rgd);
-	if (error)
-		goto fail;
-
 	error = gfs2_glock_get(sdp, rgd->rd_addr,
 			       &gfs2_rgrp_glops, CREATE, &rgd->rd_gl);
 	if (error)
 		goto fail;
 
+	error = compute_bitstructs(rgd);
+	if (error)
+		goto fail_glock;
+
 	rgd->rd_rgl = (struct gfs2_rgrp_lvb *)rgd->rd_gl->gl_lksb.sb_lvbptr;
 	rgd->rd_flags &= ~(GFS2_RDF_UPTODATE | GFS2_RDF_PREFERRED);
 	if (rgd->rd_data > sdp->sd_max_rg_data)
@@ -944,6 +944,7 @@ static int read_rindex_entry(struct gfs2_inode *ip)
 	}
 
 	error = 0; /* someone else read in the rgrp; free it and ignore it */
+fail_glock:
 	gfs2_glock_put(rgd->rd_gl);
 
 fail:
-- 
2.35.1


             reply	other threads:[~2022-04-07  1:21 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-04-07  1:12 Sasha Levin [this message]
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 02/27] rtc: fix use-after-free on device removal Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 03/27] rtc: pcf2127: fix bug when reading alarm registers Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 04/27] um: Cleanup syscall_handler_t definition/cast, fix warning Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 05/27] um: port_user: Improve error handling when port-helper is not found Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 06/27] Input: add bounds checking to input_set_capability() Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 07/27] Input: stmfts - fix reference leak in stmfts_input_open Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 08/27] nvme-pci: add quirks for Samsung X5 SSDs Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 09/27] gfs2: Disable page faults during lockless buffered reads Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 10/27] rtc: sun6i: Fix time overflow handling Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 11/27] crypto: stm32 - fix reference leak in stm32_crc_remove Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 12/27] crypto: x86/chacha20 - Avoid spurious jumps to other functions Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 13/27] ALSA: hda/realtek: Enable headset mic on Lenovo P360 Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 14/27] s390/traps: improve panic message for translation-specification exception Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 15/27] s390/pci: improve zpci_dev reference counting Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 16/27] vhost_vdpa: don't setup irq offloading when irq_num < 0 Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 17/27] tools/virtio: compile with -pthread Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 18/27] nvmet: use a private workqueue instead of the system workqueue Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 19/27] nvme-multipath: fix hang when disk goes live over reconnect Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 20/27] rtc: mc146818-lib: Fix the AltCentury for AMD platforms Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 21/27] fs: fix an infinite loop in iomap_fiemap Sasha Levin
2022-04-07 11:28   ` Amir Goldstein
2022-04-07 11:30     ` Amir Goldstein
2022-05-17 17:33       ` Amir Goldstein
2022-05-18 12:24         ` Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 22/27] MIPS: lantiq: check the return value of kzalloc() Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 23/27] drbd: remove usage of list iterator variable after loop Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 24/27] platform/chrome: cros_ec_debugfs: detach log reader wq from devm Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 25/27] ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 26/27] nilfs2: fix lockdep warnings in page operations for btree nodes Sasha Levin
2022-04-07  1:12 ` [PATCH AUTOSEL 5.15 27/27] nilfs2: fix lockdep warnings during disk space reclamation Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220407011257.114287-1-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=agruenba@redhat.com \
    --cc=cluster-devel@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=rpeterso@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+c6fd14145e2f62ca0784@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox