From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4BEEC4167D for ; Sun, 12 Nov 2023 13:29:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231720AbjKLN3V (ORCPT ); Sun, 12 Nov 2023 08:29:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44910 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231852AbjKLN2d (ORCPT ); Sun, 12 Nov 2023 08:28:33 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DB17C479E; Sun, 12 Nov 2023 05:28:04 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BA75C433C8; Sun, 12 Nov 2023 13:28:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1699795684; bh=0whF+oten6qsg0B3bNppwgKcUCrPnuzIr84eT4X31+s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=E4SfVEmtkzT/NY26CU7mJobJ1wvnBFdcc0/lETMEDm2jKrPX8eJpxOmeVacTQz6nl g9bYIZKfhvt59mPHCdkK8df+e27QunCYoL37oGsL1psyTqgaMig0KnGnul3BROo4aY YytW7hM8oczNUkH6X4PmUMeHAAVrBAgm92dWiKLYyW8+Us9o1B5AAezkZrHyl9aHTz k/CvDan0q1HlV1c8JQ2vuJ4rCzKAXwF2i83STMEAEj58TyiH+Oc0HYcuk2hk1iMxOg aiR21MfGbihrhAcuxlL3DC/VTknorgxurbYK7scwgunYJF0LO1BWVCHRPtQQ1AKTIb YtNEDoCDisN2Q== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Al Viro , Andreas Gruenbacher , Sasha Levin , swhiteho@redhat.com, rpeterso@redhat.com, cluster-devel@redhat.com Subject: [PATCH AUTOSEL 6.5 05/10] gfs2: fix an oops in gfs2_permission Date: Sun, 12 Nov 2023 08:27:48 -0500 Message-ID: <20231112132755.175757-5-sashal@kernel.org> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231112132755.175757-1-sashal@kernel.org> References: <20231112132755.175757-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.5.11 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Al Viro [ Upstream commit 0abd1557e21c617bd13fc18f7725fc6363c05913 ] In RCU mode, we might race with gfs2_evict_inode(), which zeroes ->i_gl. Freeing of the object it points to is RCU-delayed, so if we manage to fetch the pointer before it's been replaced with NULL, we are fine. Check if we'd fetched NULL and treat that as "bail out and tell the caller to get out of RCU mode". Signed-off-by: Al Viro Signed-off-by: Andreas Gruenbacher Signed-off-by: Sasha Levin --- fs/gfs2/inode.c | 11 +++++++++-- fs/gfs2/super.c | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c index 17c994a0c0d09..117b4b5a03072 100644 --- a/fs/gfs2/inode.c +++ b/fs/gfs2/inode.c @@ -1862,14 +1862,21 @@ int gfs2_permission(struct mnt_idmap *idmap, struct inode *inode, { struct gfs2_inode *ip; struct gfs2_holder i_gh; + struct gfs2_glock *gl; int error; gfs2_holder_mark_uninitialized(&i_gh); ip = GFS2_I(inode); - if (gfs2_glock_is_locked_by_me(ip->i_gl) == NULL) { + gl = rcu_dereference(ip->i_gl); + if (unlikely(!gl)) { + /* inode is getting torn down, must be RCU mode */ + WARN_ON_ONCE(!(mask & MAY_NOT_BLOCK)); + return -ECHILD; + } + if (gfs2_glock_is_locked_by_me(gl) == NULL) { if (mask & MAY_NOT_BLOCK) return -ECHILD; - error = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh); + error = gfs2_glock_nq_init(gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh); if (error) return error; } diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c index 9f4d5d6549ee6..f98ddb9d19a21 100644 --- a/fs/gfs2/super.c +++ b/fs/gfs2/super.c @@ -1558,7 +1558,7 @@ static void gfs2_evict_inode(struct inode *inode) wait_on_bit_io(&ip->i_flags, GIF_GLOP_PENDING, TASK_UNINTERRUPTIBLE); gfs2_glock_add_to_lru(ip->i_gl); gfs2_glock_put_eventually(ip->i_gl); - ip->i_gl = NULL; + rcu_assign_pointer(ip->i_gl, NULL); } } -- 2.42.0