akpm at linux-foundation.org
2014-Dec-15 22:51 UTC
[Ocfs2-devel] [patch 04/15] ocfs2: avoid access invalid address when read o2dlm debug messages
From: jiangyiwen <jiangyiwen at huawei.com> Subject: ocfs2: avoid access invalid address when read o2dlm debug messages The following case will lead to a lockres is freed but is still in use. cat /sys/kernel/debug/o2dlm/locking_state dlm_thread lockres_seq_start -> lock dlm->track_lock -> get resA resA->refs decrease to 0, call dlm_lockres_release, and wait for "cat" unlock. Although resA->refs is already set to 0, increase resA->refs, and then unlock lock dlm->track_lock -> list_del_init() -> unlock -> free resA In such a race case, invalid address access may occurs. So we should delete list res->tracking before resA->refs decrease to 0. Signed-off-by: jiangyiwen <jiangyiwen at huawei.com> Cc: Joel Becker <jlbec at evilplan.org> Cc: Mark Fasheh <mfasheh at suse.com> Signed-off-by: Andrew Morton <akpm at linux-foundation.org> --- fs/ocfs2/dlm/dlmmaster.c | 10 ---------- fs/ocfs2/dlm/dlmthread.c | 10 ++++++++++ 2 files changed, 10 insertions(+), 10 deletions(-) diff -puN fs/ocfs2/dlm/dlmmaster.c~ocfs2-avoid-access-invalid-address-when-read-o2dlm-debug-messages fs/ocfs2/dlm/dlmmaster.c --- a/fs/ocfs2/dlm/dlmmaster.c~ocfs2-avoid-access-invalid-address-when-read-o2dlm-debug-messages +++ a/fs/ocfs2/dlm/dlmmaster.c @@ -498,16 +498,6 @@ static void dlm_lockres_release(struct k mlog(0, "destroying lockres %.*s\n", res->lockname.len, res->lockname.name); - spin_lock(&dlm->track_lock); - if (!list_empty(&res->tracking)) - list_del_init(&res->tracking); - else { - mlog(ML_ERROR, "Resource %.*s not on the Tracking list\n", - res->lockname.len, res->lockname.name); - dlm_print_one_lock_resource(res); - } - spin_unlock(&dlm->track_lock); - atomic_dec(&dlm->res_cur_count); if (!hlist_unhashed(&res->hash_node) || diff -puN fs/ocfs2/dlm/dlmthread.c~ocfs2-avoid-access-invalid-address-when-read-o2dlm-debug-messages fs/ocfs2/dlm/dlmthread.c --- a/fs/ocfs2/dlm/dlmthread.c~ocfs2-avoid-access-invalid-address-when-read-o2dlm-debug-messages +++ a/fs/ocfs2/dlm/dlmthread.c @@ -211,6 +211,16 @@ static void dlm_purge_lockres(struct dlm __dlm_unhash_lockres(dlm, res); + spin_lock(&dlm->track_lock); + if (!list_empty(&res->tracking)) + list_del_init(&res->tracking); + else { + mlog(ML_ERROR, "Resource %.*s not on the Tracking list\n", + res->lockname.len, res->lockname.name); + __dlm_print_one_lock_resource(res); + } + spin_unlock(&dlm->track_lock); + /* lockres is not in the hash now. drop the flag and wake up * any processes waiting in dlm_get_lock_resource. */ if (!master) { _
Mark Fasheh
2014-Dec-16 22:26 UTC
[Ocfs2-devel] [patch 04/15] ocfs2: avoid access invalid address when read o2dlm debug messages
On Mon, Dec 15, 2014 at 02:51:00PM -0800, Andrew Morton wrote:> In such a race case, invalid address access may occurs. So we should > delete list res->tracking before resA->refs decrease to 0. >> diff -puN fs/ocfs2/dlm/dlmmaster.c~ocfs2-avoid-access-invalid-address-when-read-o2dlm-debug-messages fs/ocfs2/dlm/dlmmaster.c > --- a/fs/ocfs2/dlm/dlmmaster.c~ocfs2-avoid-access-invalid-address-when-read-o2dlm-debug-messages > +++ a/fs/ocfs2/dlm/dlmmaster.c > @@ -498,16 +498,6 @@ static void dlm_lockres_release(struct k > mlog(0, "destroying lockres %.*s\n", res->lockname.len, > res->lockname.name); > > - spin_lock(&dlm->track_lock); > - if (!list_empty(&res->tracking)) > - list_del_init(&res->tracking); > - else { > - mlog(ML_ERROR, "Resource %.*s not on the Tracking list\n", > - res->lockname.len, res->lockname.name); > - dlm_print_one_lock_resource(res); > - } > - spin_unlock(&dlm->track_lock); > - > atomic_dec(&dlm->res_cur_count); > > if (!hlist_unhashed(&res->hash_node) || > diff -puN fs/ocfs2/dlm/dlmthread.c~ocfs2-avoid-access-invalid-address-when-read-o2dlm-debug-messages fs/ocfs2/dlm/dlmthread.c > --- a/fs/ocfs2/dlm/dlmthread.c~ocfs2-avoid-access-invalid-address-when-read-o2dlm-debug-messages > +++ a/fs/ocfs2/dlm/dlmthread.c > @@ -211,6 +211,16 @@ static void dlm_purge_lockres(struct dlm > > __dlm_unhash_lockres(dlm, res); > > + spin_lock(&dlm->track_lock); > + if (!list_empty(&res->tracking)) > + list_del_init(&res->tracking); > + else { > + mlog(ML_ERROR, "Resource %.*s not on the Tracking list\n", > + res->lockname.len, res->lockname.name); > + __dlm_print_one_lock_resource(res); > + } > + spin_unlock(&dlm->track_lock); > + > /* lockres is not in the hash now. drop the flag and wake up > * any processes waiting in dlm_get_lock_resource. */ > if (!master) { > _How do we know that dlm_purge_lockres() is the last caller of dlm_lockres_put()? Don't we now have a problem where if the last ref is dropped by any other function than dlm_purge_lockres() the lockres is freed while on the tracking list? --Mark -- Mark Fasheh