]>
Commit | Line | Data |
---|---|---|
2c067dba GKH |
1 | From cbe355f57c8074bc4f452e5b6e35509044c6fa23 Mon Sep 17 00:00:00 2001 |
2 | From: Ashish Samant <ashish.samant@oracle.com> | |
3 | Date: Fri, 5 Oct 2018 15:52:15 -0700 | |
4 | Subject: ocfs2: fix locking for res->tracking and dlm->tracking_list | |
5 | ||
6 | From: Ashish Samant <ashish.samant@oracle.com> | |
7 | ||
8 | commit cbe355f57c8074bc4f452e5b6e35509044c6fa23 upstream. | |
9 | ||
10 | In dlm_init_lockres() we access and modify res->tracking and | |
11 | dlm->tracking_list without holding dlm->track_lock. This can cause list | |
12 | corruptions and can end up in kernel panic. | |
13 | ||
14 | Fix this by locking res->tracking and dlm->tracking_list with | |
15 | dlm->track_lock instead of dlm->spinlock. | |
16 | ||
17 | Link: http://lkml.kernel.org/r/1529951192-4686-1-git-send-email-ashish.samant@oracle.com | |
18 | Signed-off-by: Ashish Samant <ashish.samant@oracle.com> | |
19 | Reviewed-by: Changwei Ge <ge.changwei@h3c.com> | |
20 | Acked-by: Joseph Qi <jiangqi903@gmail.com> | |
21 | Acked-by: Jun Piao <piaojun@huawei.com> | |
22 | Cc: Mark Fasheh <mark@fasheh.com> | |
23 | Cc: Joel Becker <jlbec@evilplan.org> | |
24 | Cc: Junxiao Bi <junxiao.bi@oracle.com> | |
25 | Cc: Changwei Ge <ge.changwei@h3c.com> | |
26 | Cc: <stable@vger.kernel.org> | |
27 | Signed-off-by: Andrew Morton <akpm@linux-foundation.org> | |
28 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
29 | ||
30 | --- | |
31 | fs/ocfs2/dlm/dlmmaster.c | 4 ++-- | |
32 | 1 file changed, 2 insertions(+), 2 deletions(-) | |
33 | ||
34 | --- a/fs/ocfs2/dlm/dlmmaster.c | |
35 | +++ b/fs/ocfs2/dlm/dlmmaster.c | |
36 | @@ -589,9 +589,9 @@ static void dlm_init_lockres(struct dlm_ | |
37 | ||
38 | res->last_used = 0; | |
39 | ||
40 | - spin_lock(&dlm->spinlock); | |
41 | + spin_lock(&dlm->track_lock); | |
42 | list_add_tail(&res->tracking, &dlm->tracking_list); | |
43 | - spin_unlock(&dlm->spinlock); | |
44 | + spin_unlock(&dlm->track_lock); | |
45 | ||
46 | memset(res->lvb, 0, DLM_LVB_LEN); | |
47 | memset(res->refmap, 0, sizeof(res->refmap)); |