From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E17D2C87B; Fri, 24 Nov 2023 19:03:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="KLpTJ4yl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA219C433C7; Fri, 24 Nov 2023 19:03:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1700852606; bh=N7dLAx/bKFjNW+HZfEkUdKqr4GpCWSQ9HUg2OueJnK8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KLpTJ4ylIocOeLv2gTSsi9fe5To6WGXhiivd/3KFGqigC/5dmleJVJzlxsfpiamIZ jXGAXhEpO+WSnB2KIjQtEPBgM8y+d1gn+gFhmBzIXZ0eOG9fjQRdLmXr2wK6t9GOjn IsYa7bP7TP3x0DXzCXqlmNR0WrwKea/D/rIgSvvc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Al Viro , Andreas Gruenbacher , Sasha Levin Subject: [PATCH 5.10 050/193] gfs2: fix an oops in gfs2_permission Date: Fri, 24 Nov 2023 17:52:57 +0000 Message-ID: <20231124171949.275597808@linuxfoundation.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231124171947.127438872@linuxfoundation.org> References: <20231124171947.127438872@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Al Viro [ Upstream commit 0abd1557e21c617bd13fc18f7725fc6363c05913 ] In RCU mode, we might race with gfs2_evict_inode(), which zeroes ->i_gl. Freeing of the object it points to is RCU-delayed, so if we manage to fetch the pointer before it's been replaced with NULL, we are fine. Check if we'd fetched NULL and treat that as "bail out and tell the caller to get out of RCU mode". Signed-off-by: Al Viro Signed-off-by: Andreas Gruenbacher Signed-off-by: Sasha Levin --- fs/gfs2/inode.c | 11 +++++++++-- fs/gfs2/super.c | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c index 74a6b0800e059..963dc72e7155f 100644 --- a/fs/gfs2/inode.c +++ b/fs/gfs2/inode.c @@ -1837,14 +1837,21 @@ int gfs2_permission(struct inode *inode, int mask) { struct gfs2_inode *ip; struct gfs2_holder i_gh; + struct gfs2_glock *gl; int error; gfs2_holder_mark_uninitialized(&i_gh); ip = GFS2_I(inode); - if (gfs2_glock_is_locked_by_me(ip->i_gl) == NULL) { + gl = rcu_dereference(ip->i_gl); + if (unlikely(!gl)) { + /* inode is getting torn down, must be RCU mode */ + WARN_ON_ONCE(!(mask & MAY_NOT_BLOCK)); + return -ECHILD; + } + if (gfs2_glock_is_locked_by_me(gl) == NULL) { if (mask & MAY_NOT_BLOCK) return -ECHILD; - error = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh); + error = gfs2_glock_nq_init(gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh); if (error) return error; } diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c index b61de8dab51a0..8cf4ef61cdc41 100644 --- a/fs/gfs2/super.c +++ b/fs/gfs2/super.c @@ -1471,7 +1471,7 @@ static void gfs2_evict_inode(struct inode *inode) wait_on_bit_io(&ip->i_flags, GIF_GLOP_PENDING, TASK_UNINTERRUPTIBLE); gfs2_glock_add_to_lru(ip->i_gl); gfs2_glock_put_eventually(ip->i_gl); - ip->i_gl = NULL; + rcu_assign_pointer(ip->i_gl, NULL); } } -- 2.42.0