[PATCH] ocfs2/cluster: remove zero-address nodes from IP tree on teardown

[PATCH] ocfs2/cluster: remove zero-address nodes from IP tree on teardown

[Cen Zhang]

o2nm_node_ipv4_address_store() accepts 0.0.0.0. It sets
O2NM_NODE_ATTR_ADDRESS and links nd_ip_node into cl_node_ip_tree under
cl_nodes_lock, but o2nm_node_group_drop_item() uses nd_ipv4_address as a
membership test. A zero address therefore leaves the rbtree node linked
when config_item_put() releases and frees struct o2nm_node. A later
address store or IP lookup can then walk the stale node and dereference
freed memory.

During teardown, drop_item takes cl_nodes_lock, skips rb_erase()
for the zero key, and then calls config_item_put(). A later
o2nm_node_ipv4_address_store() duplicate check or o2nm_get_node_by_ip()
lookup takes the same lock and walks the stale cl_node_ip_tree entry. Use
O2NM_NODE_ATTR_ADDRESS for teardown so every published nd_ip_node is
erased before configfs can release the node, without rejecting 0.0.0.0
or changing lookup semantics.

Fixes: 0c83ed8eeb28 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
 fs/ocfs2/cluster/nodemanager.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index e08850a5d736..be184c5ad54d 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -626,8 +626,11 @@ static void o2nm_node_group_drop_item(struct config_group *group,
 
 	write_lock(&cluster->cl_nodes_lock);
 
-	/* XXX sloppy */
-	if (node->nd_ipv4_address)
+	/*
+	 * 0.0.0.0 is a valid configured address, so nd_ipv4_address does
+	 * not tell us whether nd_ip_node was published in the IP tree.
+	 */
+	if (test_bit(O2NM_NODE_ATTR_ADDRESS, &node->nd_set_attributes))
 		rb_erase(&node->nd_ip_node, &cluster->cl_node_ip_tree);
 
 	/* nd_num might be 0 if the node number hasn't been set.. */

Re: [PATCH] ocfs2/cluster: remove zero-address nodes from IP tree on teardown

[Joseph Qi]

On 10/20/26 9:12 PM, Cen Zhang wrote:
> o2nm_node_ipv4_address_store() accepts 0.0.0.0. It sets
> O2NM_NODE_ATTR_ADDRESS and links nd_ip_node into cl_node_ip_tree under
> cl_nodes_lock, but o2nm_node_group_drop_item() uses nd_ipv4_address as a
> membership test. A zero address therefore leaves the rbtree node linked
> when config_item_put() releases and frees struct o2nm_node. A later
> address store or IP lookup can then walk the stale node and dereference
> freed memory.
> 
> During teardown, drop_item takes cl_nodes_lock, skips rb_erase()
> for the zero key, and then calls config_item_put(). A later
> o2nm_node_ipv4_address_store() duplicate check or o2nm_get_node_by_ip()
> lookup takes the same lock and walks the stale cl_node_ip_tree entry. Use
> O2NM_NODE_ATTR_ADDRESS for teardown so every published nd_ip_node is
> erased before configfs can release the node, without rejecting 0.0.0.0
> or changing lookup semantics.
> 
> Fixes: 0c83ed8eeb28 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>

Looks fine.
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>

> ---
>  fs/ocfs2/cluster/nodemanager.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
> index e08850a5d736..be184c5ad54d 100644
> --- a/fs/ocfs2/cluster/nodemanager.c
> +++ b/fs/ocfs2/cluster/nodemanager.c
> @@ -626,8 +626,11 @@ static void o2nm_node_group_drop_item(struct config_group *group,
>  
>  	write_lock(&cluster->cl_nodes_lock);
>  
> -	/* XXX sloppy */
> -	if (node->nd_ipv4_address)
> +	/*
> +	 * 0.0.0.0 is a valid configured address, so nd_ipv4_address does
> +	 * not tell us whether nd_ip_node was published in the IP tree.
> +	 */
> +	if (test_bit(O2NM_NODE_ATTR_ADDRESS, &node->nd_set_attributes))
>  		rb_erase(&node->nd_ip_node, &cluster->cl_node_ip_tree);
>  
>  	/* nd_num might be 0 if the node number hasn't been set.. */