]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob - releases/4.4.160/ocfs2-fix-locking-for-res-tracking-and-dlm-tracking_list.patch
4.9-stable patches
[thirdparty/kernel/stable-queue.git] / releases / 4.4.160 / ocfs2-fix-locking-for-res-tracking-and-dlm-tracking_list.patch
1 From cbe355f57c8074bc4f452e5b6e35509044c6fa23 Mon Sep 17 00:00:00 2001
2 From: Ashish Samant <ashish.samant@oracle.com>
3 Date: Fri, 5 Oct 2018 15:52:15 -0700
4 Subject: ocfs2: fix locking for res->tracking and dlm->tracking_list
5
6 From: Ashish Samant <ashish.samant@oracle.com>
7
8 commit cbe355f57c8074bc4f452e5b6e35509044c6fa23 upstream.
9
10 In dlm_init_lockres() we access and modify res->tracking and
11 dlm->tracking_list without holding dlm->track_lock. This can cause list
12 corruptions and can end up in kernel panic.
13
14 Fix this by locking res->tracking and dlm->tracking_list with
15 dlm->track_lock instead of dlm->spinlock.
16
17 Link: http://lkml.kernel.org/r/1529951192-4686-1-git-send-email-ashish.samant@oracle.com
18 Signed-off-by: Ashish Samant <ashish.samant@oracle.com>
19 Reviewed-by: Changwei Ge <ge.changwei@h3c.com>
20 Acked-by: Joseph Qi <jiangqi903@gmail.com>
21 Acked-by: Jun Piao <piaojun@huawei.com>
22 Cc: Mark Fasheh <mark@fasheh.com>
23 Cc: Joel Becker <jlbec@evilplan.org>
24 Cc: Junxiao Bi <junxiao.bi@oracle.com>
25 Cc: Changwei Ge <ge.changwei@h3c.com>
26 Cc: <stable@vger.kernel.org>
27 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
28 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
29
30 ---
31 fs/ocfs2/dlm/dlmmaster.c | 4 ++--
32 1 file changed, 2 insertions(+), 2 deletions(-)
33
34 --- a/fs/ocfs2/dlm/dlmmaster.c
35 +++ b/fs/ocfs2/dlm/dlmmaster.c
36 @@ -589,9 +589,9 @@ static void dlm_init_lockres(struct dlm_
37
38 res->last_used = 0;
39
40 - spin_lock(&dlm->spinlock);
41 + spin_lock(&dlm->track_lock);
42 list_add_tail(&res->tracking, &dlm->tracking_list);
43 - spin_unlock(&dlm->spinlock);
44 + spin_unlock(&dlm->track_lock);
45
46 memset(res->lvb, 0, DLM_LVB_LEN);
47 memset(res->refmap, 0, sizeof(res->refmap));