OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/fs/gfs2
History
Hillf Danton 86fd5b27db gfs2: Fix use-after-free in gfs2_glock_shrink_scan 
[ Upstream commit 1ab19c5de4c537ec0d9b21020395a5b5a6c059b2 ]

The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to
remove the glock from the lru list in __gfs2_glock_put().

On the shrink scan path, the same flag is cleared under lru_lock but because
of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the
put side can be made without deleting the glock from the lru list.

Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to
ensure correct behavior on both sides - clear GLF_LRU after list_del under
lru_lock.

Reported-by: syzbot <syzbot+34ba7ddbf3021981a228@syzkaller.appspotmail.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2021-06-18 09:58:59 +02:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
acl.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
acl.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
aops.c gfs2: Minor PAGE_SIZE arithmetic cleanups 2019-09-04 20:22:06 +02:00
aops.h gfs2: mark stuffed_readpage static 2019-07-03 14:45:18 +02:00
bmap.c gfs2: Recursive gfs2_quota_hold in gfs2_iomap_end 2021-03-04 10:26:51 +01:00
bmap.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
dentry.c gfs2: untangle the logic in gfs2_drevalidate 2019-09-03 09:42:41 +02:00
dir.c gfs2: Delete an unnecessary check before brelse() 2019-09-04 20:22:17 +02:00
dir.h gfs2: Delete an unnecessary check before brelse() 2019-09-04 20:22:17 +02:00
export.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
file.c gfs2: Prevent direct-I/O write fallback errors from getting lost 2021-06-18 09:58:58 +02:00
gfs2.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
glock.c gfs2: Fix use-after-free in gfs2_glock_shrink_scan 2021-06-18 09:58:59 +02:00
glock.h gfs2: Use async glocks for rename 2019-09-04 20:22:17 +02:00
glops.c gfs2: initialize transaction tr_ailX_lists earlier 2020-09-23 12:40:33 +02:00
glops.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
incore.h gfs2: use-after-free in sysfs deregistration 2020-11-05 11:43:21 +01:00
inode.c gfs2: clean up iopen glock mess in gfs2_create_inode 2020-10-01 13:17:20 +02:00
inode.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
lock_dlm.c gfs2: Don't skip dlm unlock if glock has an lvb 2021-03-04 10:26:51 +01:00
log.c gfs2: initialize transaction tr_ailX_lists earlier 2020-09-23 12:40:33 +02:00
log.h gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty 2020-04-17 10:50:03 +02:00
lops.c gfs2: Even more gfs2_find_jhead fixes 2020-06-17 16:40:21 +02:00
lops.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
main.c SPDX update for 5.2-rc4 2019-06-08 12:52:42 -07:00
meta_io.c gfs2: Rename SDF_SHUTDOWN to SDF_WITHDRAWN 2019-06-27 21:26:35 +02:00
meta_io.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
ops_fstype.c gfs2: add validation checks for size of superblock 2020-11-05 11:43:21 +01:00
quota.c gfs2: move privileged user check to gfs2_quota_lock_check 2020-06-03 08:21:09 +02:00
quota.h gfs2: move privileged user check to gfs2_quota_lock_check 2020-06-03 08:21:09 +02:00
recovery.c gfs2: log which portion of the journal is replayed 2019-06-27 21:03:58 +02:00
recovery.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
rgrp.c gfs2: check for empty rgrp tree in gfs2_ri_update 2020-12-11 13:23:32 +01:00
rgrp.h gfs2: dump fsid when dumping glock problems 2019-06-27 21:27:43 +02:00
super.c gfs2: report "already frozen/thawed" errors 2021-04-16 11:46:37 +02:00
super.h gfs2: Convert gfs2 to fs_context 2019-09-18 22:47:05 -04:00
sys.c gfs2: use-after-free in sysfs deregistration 2020-11-05 11:43:21 +01:00
sys.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
trace_gfs2.h gfs2: eliminate rs_inum and reduce the size of gfs2 inodes 2018-06-21 07:39:31 -05:00
trans.c gfs2: initialize transaction tr_ailX_lists earlier 2020-09-23 12:40:33 +02:00
trans.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
util.c gfs2: Fix possible fs name overflows 2019-09-03 09:42:41 +02:00
util.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
xattr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
xattr.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00