[PATCH] autofs: serialize allocation of global wait queue tokens

[PATCH] autofs: serialize allocation of global wait queue tokens

[Zhu Jun]

autofs_next_wait_queue is shared by all autofs superblocks, while
sbi->wq_mutex only serializes requests on one superblock. Concurrent
requests on different mounts can therefore lose updates to the global
counter. A delayed update can also move it backwards, allowing an
outstanding token to be reused on a mount.

Protect token allocation with a global spinlock. Keep the existing token
type and the wraparound rule that reserves zero.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 fs/autofs/waitq.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/autofs/waitq.c b/fs/autofs/waitq.c
index 92c0bbbf452b..22bc59c2f63e 100644
--- a/fs/autofs/waitq.c
+++ b/fs/autofs/waitq.c
@@ -5,12 +5,14 @@
  */
 
 #include <linux/sched/signal.h>
+#include <linux/spinlock.h>
 #include "autofs_i.h"
 
 /* We make this a static variable rather than a part of the superblock; it
  * is better if we don't reassign numbers easily even across filesystems
  */
 static autofs_wqt_t autofs_next_wait_queue = 1;
+static DEFINE_SPINLOCK(autofs_wait_queue_lock);
 
 static void autofs_catatonic_mode_locked(struct autofs_sb_info *sbi)
 {
@@ -396,9 +398,11 @@ int autofs_wait(struct autofs_sb_info *sbi,
 			return -ENOMEM;
 		}
 
+		spin_lock(&autofs_wait_queue_lock);
 		wq->wait_queue_token = autofs_next_wait_queue;
 		if (++autofs_next_wait_queue == 0)
 			autofs_next_wait_queue = 1;
+		spin_unlock(&autofs_wait_queue_lock);
 		wq->next = sbi->queues;
 		sbi->queues = wq;
 		init_waitqueue_head(&wq->queue);
-- 
2.51.0

Re: [PATCH] autofs: serialize allocation of global wait queue tokens

[Ian Kent]

On Wed, 2026-11-11 at 11:40 +0800, Zhu Jun wrote:
> autofs_next_wait_queue is shared by all autofs superblocks, while
> sbi->wq_mutex only serializes requests on one superblock. Concurrent
> requests on different mounts can therefore lose updates to the global
> counter. A delayed update can also move it backwards, allowing an
> outstanding token to be reused on a mount.
> 
> Protect token allocation with a global spinlock. Keep the existing
> token
> type and the wraparound rule that reserves zero.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

Yeah, good catch ...

Acked-by: Ian Kent <raven@themaw.net>

> ---
>  fs/autofs/waitq.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/autofs/waitq.c b/fs/autofs/waitq.c
> index 92c0bbbf452b..22bc59c2f63e 100644
> --- a/fs/autofs/waitq.c
> +++ b/fs/autofs/waitq.c
> @@ -5,12 +5,14 @@
>   */
>  
>  #include <linux/sched/signal.h>
> +#include <linux/spinlock.h>
>  #include "autofs_i.h"
>  
>  /* We make this a static variable rather than a part of the
> superblock; it
>   * is better if we don't reassign numbers easily even across
> filesystems
>   */
>  static autofs_wqt_t autofs_next_wait_queue = 1;
> +static DEFINE_SPINLOCK(autofs_wait_queue_lock);
>  
>  static void autofs_catatonic_mode_locked(struct autofs_sb_info *sbi)
>  {
> @@ -396,9 +398,11 @@ int autofs_wait(struct autofs_sb_info *sbi,
>  			return -ENOMEM;
>  		}
>  
> +		spin_lock(&autofs_wait_queue_lock);
>  		wq->wait_queue_token = autofs_next_wait_queue;
>  		if (++autofs_next_wait_queue == 0)
>  			autofs_next_wait_queue = 1;
> +		spin_unlock(&autofs_wait_queue_lock);
>  		wq->next = sbi->queues;
>  		sbi->queues = wq;
>  		init_waitqueue_head(&wq->queue);

[PATCH] autofs: serialize allocation of global wait queue tokens

[Zhu Jun]

autofs_next_wait_queue is shared by all autofs superblocks, while
sbi->wq_mutex only serializes requests on one superblock. Concurrent
requests on different mounts can therefore lose updates to the global
counter. A delayed update can also move it backwards, allowing an
outstanding token to be reused on a mount.

Protect token allocation with a global spinlock. Keep the existing token
type and the wraparound rule that reserves zero.

Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 fs/autofs/waitq.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/autofs/waitq.c b/fs/autofs/waitq.c
index 92c0bbbf452b..22bc59c2f63e 100644
--- a/fs/autofs/waitq.c
+++ b/fs/autofs/waitq.c
@@ -5,12 +5,14 @@
  */
 
 #include <linux/sched/signal.h>
+#include <linux/spinlock.h>
 #include "autofs_i.h"
 
 /* We make this a static variable rather than a part of the superblock; it
  * is better if we don't reassign numbers easily even across filesystems
  */
 static autofs_wqt_t autofs_next_wait_queue = 1;
+static DEFINE_SPINLOCK(autofs_wait_queue_lock);
 
 static void autofs_catatonic_mode_locked(struct autofs_sb_info *sbi)
 {
@@ -396,9 +398,11 @@ int autofs_wait(struct autofs_sb_info *sbi,
 			return -ENOMEM;
 		}
 
+		spin_lock(&autofs_wait_queue_lock);
 		wq->wait_queue_token = autofs_next_wait_queue;
 		if (++autofs_next_wait_queue == 0)
 			autofs_next_wait_queue = 1;
+		spin_unlock(&autofs_wait_queue_lock);
 		wq->next = sbi->queues;
 		sbi->queues = wq;
 		init_waitqueue_head(&wq->queue);
-- 
2.51.0