]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blame - releases/4.9.132/ocfs2-fix-locking-for-res-tracking-and-dlm-tracking_list.patch
Linux 4.14.95
[thirdparty/kernel/stable-queue.git] / releases / 4.9.132 / ocfs2-fix-locking-for-res-tracking-and-dlm-tracking_list.patch
CommitLineData
2c067dba
GKH
1From cbe355f57c8074bc4f452e5b6e35509044c6fa23 Mon Sep 17 00:00:00 2001
2From: Ashish Samant <ashish.samant@oracle.com>
3Date: Fri, 5 Oct 2018 15:52:15 -0700
4Subject: ocfs2: fix locking for res->tracking and dlm->tracking_list
5
6From: Ashish Samant <ashish.samant@oracle.com>
7
8commit cbe355f57c8074bc4f452e5b6e35509044c6fa23 upstream.
9
10In dlm_init_lockres() we access and modify res->tracking and
11dlm->tracking_list without holding dlm->track_lock. This can cause list
12corruptions and can end up in kernel panic.
13
14Fix this by locking res->tracking and dlm->tracking_list with
15dlm->track_lock instead of dlm->spinlock.
16
17Link: http://lkml.kernel.org/r/1529951192-4686-1-git-send-email-ashish.samant@oracle.com
18Signed-off-by: Ashish Samant <ashish.samant@oracle.com>
19Reviewed-by: Changwei Ge <ge.changwei@h3c.com>
20Acked-by: Joseph Qi <jiangqi903@gmail.com>
21Acked-by: Jun Piao <piaojun@huawei.com>
22Cc: Mark Fasheh <mark@fasheh.com>
23Cc: Joel Becker <jlbec@evilplan.org>
24Cc: Junxiao Bi <junxiao.bi@oracle.com>
25Cc: Changwei Ge <ge.changwei@h3c.com>
26Cc: <stable@vger.kernel.org>
27Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
28Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
29
30---
31 fs/ocfs2/dlm/dlmmaster.c | 4 ++--
32 1 file changed, 2 insertions(+), 2 deletions(-)
33
34--- a/fs/ocfs2/dlm/dlmmaster.c
35+++ b/fs/ocfs2/dlm/dlmmaster.c
36@@ -589,9 +589,9 @@ static void dlm_init_lockres(struct dlm_
37
38 res->last_used = 0;
39
40- spin_lock(&dlm->spinlock);
41+ spin_lock(&dlm->track_lock);
42 list_add_tail(&res->tracking, &dlm->tracking_list);
43- spin_unlock(&dlm->spinlock);
44+ spin_unlock(&dlm->track_lock);
45
46 memset(res->lvb, 0, DLM_LVB_LEN);
47 memset(res->refmap, 0, sizeof(res->refmap));