queue-4.9/fs-ocfs2-fix-race-in-ocfs2_dentry_attach_lock.patch

   1 From be99ca2716972a712cde46092c54dee5e6192bf8 Mon Sep 17 00:00:00 2001
   2 From: Wengang Wang <wen.gang.wang@oracle.com>
   3 Date: Thu, 13 Jun 2019 15:56:01 -0700
   4 Subject: fs/ocfs2: fix race in ocfs2_dentry_attach_lock()
   5
   6 From: Wengang Wang <wen.gang.wang@oracle.com>
   7
   8 commit be99ca2716972a712cde46092c54dee5e6192bf8 upstream.
   9
  10 ocfs2_dentry_attach_lock() can be executed in parallel threads against the
  11 same dentry.  Make that race safe.  The race is like this:
  12
  13             thread A                               thread B
  14
  15 (A1) enter ocfs2_dentry_attach_lock,
  16 seeing dentry->d_fsdata is NULL,
  17 and no alias found by
  18 ocfs2_find_local_alias, so kmalloc
  19 a new ocfs2_dentry_lock structure
  20 to local variable "dl", dl1
  21
  22                .....
  23
  24                                     (B1) enter ocfs2_dentry_attach_lock,
  25                                     seeing dentry->d_fsdata is NULL,
  26                                     and no alias found by
  27                                     ocfs2_find_local_alias so kmalloc
  28                                     a new ocfs2_dentry_lock structure
  29                                     to local variable "dl", dl2.
  30
  31                                                    ......
  32
  33 (A2) set dentry->d_fsdata with dl1,
  34 call ocfs2_dentry_lock() and increase
  35 dl1->dl_lockres.l_ro_holders to 1 on
  36 success.
  37               ......
  38
  39                                     (B2) set dentry->d_fsdata with dl2
  40                                     call ocfs2_dentry_lock() and increase
  41                                     dl2->dl_lockres.l_ro_holders to 1 on
  42                                     success.
  43
  44                                                   ......
  45
  46 (A3) call ocfs2_dentry_unlock()
  47 and decrease
  48 dl2->dl_lockres.l_ro_holders to 0
  49 on success.
  50              ....
  51
  52                                     (B3) call ocfs2_dentry_unlock(),
  53                                     decreasing
  54                                     dl2->dl_lockres.l_ro_holders, but
  55                                     see it's zero now, panic
  56
  57 Link: http://lkml.kernel.org/r/20190529174636.22364-1-wen.gang.wang@oracle.com
  58 Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com>
  59 Reported-by: Daniel Sobe <daniel.sobe@nxp.com>
  60 Tested-by: Daniel Sobe <daniel.sobe@nxp.com>
  61 Reviewed-by: Changwei Ge <gechangwei@live.cn>
  62 Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
  63 Cc: Mark Fasheh <mark@fasheh.com>
  64 Cc: Joel Becker <jlbec@evilplan.org>
  65 Cc: Junxiao Bi <junxiao.bi@oracle.com>
  66 Cc: Gang He <ghe@suse.com>
  67 Cc: Jun Piao <piaojun@huawei.com>
  68 Cc: <stable@vger.kernel.org>
  69 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  70 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  71 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  72
  73 ---
  74  fs/ocfs2/dcache.c |   12 ++++++++++++
  75  1 file changed, 12 insertions(+)
  76
  77 --- a/fs/ocfs2/dcache.c
  78 +++ b/fs/ocfs2/dcache.c
  79 @@ -310,6 +310,18 @@ int ocfs2_dentry_attach_lock(struct dent
  80
  81  out_attach:
  82         spin_lock(&dentry_attach_lock);
  83 +       if (unlikely(dentry->d_fsdata && !alias)) {
  84 +               /* d_fsdata is set by a racing thread which is doing
  85 +                * the same thing as this thread is doing. Leave the racing
  86 +                * thread going ahead and we return here.
  87 +                */
  88 +               spin_unlock(&dentry_attach_lock);
  89 +               iput(dl->dl_inode);
  90 +               ocfs2_lock_res_free(&dl->dl_lockres);
  91 +               kfree(dl);
  92 +               return 0;
  93 +       }
  94 +
  95         dentry->d_fsdata = dl;
  96         dl->dl_count++;
  97         spin_unlock(&dentry_attach_lock);