From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Hillf Danton <hdanton@sina.com>,
syzbot <syzbot+34ba7ddbf3021981a228@syzkaller.appspotmail.com>,
Andreas Gruenbacher <agruenba@redhat.com>,
Sasha Levin <sashal@kernel.org>,
cluster-devel@redhat.com
Subject: [PATCH AUTOSEL 4.4 06/14] gfs2: Fix use-after-free in gfs2_glock_shrink_scan
Date: Mon, 7 Jun 2021 12:15:57 -0400 [thread overview]
Message-ID: <20210607161605.3584954-6-sashal@kernel.org> (raw)
In-Reply-To: <20210607161605.3584954-1-sashal@kernel.org>
From: Hillf Danton <hdanton@sina.com>
[ Upstream commit 1ab19c5de4c537ec0d9b21020395a5b5a6c059b2 ]
The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to
remove the glock from the lru list in __gfs2_glock_put().
On the shrink scan path, the same flag is cleared under lru_lock but because
of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the
put side can be made without deleting the glock from the lru list.
Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to
ensure correct behavior on both sides - clear GLF_LRU after list_del under
lru_lock.
Reported-by: syzbot <syzbot+34ba7ddbf3021981a228@syzkaller.appspotmail.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 8e8695eb652a..f115ce93dfb4 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1342,6 +1342,7 @@ __acquires(&lru_lock)
while(!list_empty(list)) {
gl = list_entry(list->next, struct gfs2_glock, gl_lru);
list_del_init(&gl->gl_lru);
+ clear_bit(GLF_LRU, &gl->gl_flags);
if (!spin_trylock(&gl->gl_lockref.lock)) {
add_back_to_lru:
list_add(&gl->gl_lru, &lru_list);
@@ -1388,7 +1389,6 @@ static long gfs2_scan_glock_lru(int nr)
if (!test_bit(GLF_LOCK, &gl->gl_flags)) {
list_move(&gl->gl_lru, &dispose);
atomic_dec(&lru_count);
- clear_bit(GLF_LRU, &gl->gl_flags);
freed++;
continue;
}
--
2.30.2
next prev parent reply other threads:[~2021-06-07 16:25 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-07 16:15 [PATCH AUTOSEL 4.4 01/14] HID: hid-sensor-hub: Return error for hid_set_field() failure Sasha Levin
2021-06-07 16:15 ` [PATCH AUTOSEL 4.4 02/14] HID: Add BUS_VIRTUAL to hid_connect logging Sasha Levin
2021-06-07 16:15 ` [PATCH AUTOSEL 4.4 03/14] HID: usbhid: fix info leak in hid_submit_ctrl Sasha Levin
2021-06-07 16:15 ` [PATCH AUTOSEL 4.4 04/14] ARM: OMAP2+: Fix build warning when mmc_omap is not built Sasha Levin
2021-06-07 16:15 ` [PATCH AUTOSEL 4.4 05/14] HID: gt683r: add missing MODULE_DEVICE_TABLE Sasha Levin
2021-06-07 16:15 ` Sasha Levin [this message]
2021-06-07 16:15 ` [PATCH AUTOSEL 4.4 07/14] Bluetooth: use correct lock to prevent UAF of hdev object Sasha Levin
2021-06-07 16:15 ` [PATCH AUTOSEL 4.4 08/14] scsi: target: core: Fix warning on realtime kernels Sasha Levin
2021-06-07 16:16 ` [PATCH AUTOSEL 4.4 09/14] ethernet: myri10ge: Fix missing error code in myri10ge_probe() Sasha Levin
2021-06-07 16:16 ` [PATCH AUTOSEL 4.4 10/14] net: ipconfig: Don't override command-line hostnames or domains Sasha Levin
2021-06-07 16:16 ` [PATCH AUTOSEL 4.4 11/14] rtnetlink: Fix missing error code in rtnl_bridge_notify() Sasha Levin
2021-06-07 16:16 ` [PATCH AUTOSEL 4.4 12/14] net/x25: Return the correct errno code Sasha Levin
2021-06-07 16:16 ` [PATCH AUTOSEL 4.4 13/14] net: " Sasha Levin
2021-06-07 16:16 ` [PATCH AUTOSEL 4.4 14/14] fib: " Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210607161605.3584954-6-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=agruenba@redhat.com \
--cc=cluster-devel@redhat.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+34ba7ddbf3021981a228@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).