Re: [PATCH v2] ocfs2: keep locking_state within the cluster connection lifetime

[Joseph Qi <joseph.qi@linux.alibaba.com>]

On 10/27/26 12:31 PM, Cen Zhang wrote:
> The locking_state reader calls ocfs2_dlm_lvb() through the selected
> cluster stack. Its debug-object reference keeps the tracking list alive,
> but does not keep that stack selected without a cluster connection.
> 
> DLM initialization publishes the file before establishing its connection,
> and DLM shutdown drops the connection while the file still exists. Both
> the mount error unwind in ocfs2_mount_volume() and ocfs2_dismount_volume()
> remove the debugfs subtree only after ocfs2_dlm_shutdown() has returned.
> Whenever the disconnect releases the last stack reference, which is the
> case for a failed mount and for any unmount without a pending hangup, a
> concurrent reader dereferences a NULL active_stack:
> 
>   Mount error unwind                  Debugfs reader
>   ------------------                  --------------
>   ocfs2_mount_volume(): out_dlm
>     ocfs2_dlm_shutdown()
>       disconnect last cluster
>         clear active_stack
>                                       read locking_state
>                                         ocfs2_dlm_seq_show()
>                                           ocfs2_dlm_lvb()
>                                             dereference active_stack
>   fill_super(): out_debugfs
>     remove debugfs subtree
> 
> Publish the debug files only after the connection and the mount lock
> resources are initialized, so a failed DLM initialization has no debug
> reference to drop. Remove them again in the common DLM shutdown helper
> before the connection is dropped: debugfs removal waits for readers that
> are inside the file operations, and the parent directory is still present
> at that point in every caller. This covers the mount error unwind, the
> ocfs2_fill_super() failures after a successful mount that dismount with
> mnt_err set, and unmounts whose disconnect releases the stack directly.
> 
> Only the relevant frames of the report are kept:
> 
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> RIP: 0010:ocfs2_dlm_lvb+0x38/0xf0
> Call Trace:
>  <TASK>
>  ocfs2_dlm_seq_show+0x36a/0xb70
>  seq_read_iter+0x480/0x1110
>  seq_read+0x362/0x5a0
>  full_proxy_read+0x11f/0x180
>  vfs_read+0x1a0/0xc20
>  ksys_read+0x111/0x200
>  </TASK>
> 
> Fixes: 286eaa95c5c5 ("ocfs2: Break out stackglue into modules.")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>

Looks fine.
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>