gfs2: Fix potential glock use-after-free on unmount

[ Upstream commit d98779e687726d8f8860f1c54b5687eec5f63a73 ]

When a DLM lockspace is released and there ares still locks in that
lockspace, DLM will unlock those locks automatically.  Commit
fb6791d100d1b started exploiting this behavior to speed up filesystem
unmount: gfs2 would simply free glocks it didn't want to unlock and then
release the lockspace.  This didn't take the bast callbacks for
asynchronous lock contention notifications into account, which remain
active until until a lock is unlocked or its lockspace is released.

To prevent those callbacks from accessing deallocated objects, put the
glocks that should not be unlocked on the sd_dead_glocks list, release
the lockspace, and only then free those glocks.

As an additional measure, ignore unexpected ast and bast callbacks if
the receiving glock is dead.

Fixes: fb6791d100d1b ("GFS2: skip dlm_unlock calls in unmount")
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Cc: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 5d5b3235d4e591ee6fb7d1eff50ce8c22baaf055..1bf0d751ece0ac051b08c43a84a6d94c16fa90e4 100644 (file)
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -166,18 +166,45 @@ static bool glock_blocked_by_withdraw(struct gfs2_glock *gl)
        return true;
 }
 
-void gfs2_glock_free(struct gfs2_glock *gl)
+static void __gfs2_glock_free(struct gfs2_glock *gl)
 {
-       struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
-
        rhashtable_remove_fast(&gl_hash_table, &gl->gl_node, ht_parms);
        smp_mb();
        wake_up_glock(gl);
        call_rcu(&gl->gl_rcu, gfs2_glock_dealloc);
+}
+
+void gfs2_glock_free(struct gfs2_glock *gl) {
+       struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+
+       __gfs2_glock_free(gl);
        if (atomic_dec_and_test(&sdp->sd_glock_disposal))
                wake_up(&sdp->sd_kill_wait);
 }
 
+void gfs2_glock_free_later(struct gfs2_glock *gl) {
+       struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+
+       spin_lock(&lru_lock);
+       list_add(&gl->gl_lru, &sdp->sd_dead_glocks);
+       spin_unlock(&lru_lock);
+       if (atomic_dec_and_test(&sdp->sd_glock_disposal))
+               wake_up(&sdp->sd_kill_wait);
+}
+
+static void gfs2_free_dead_glocks(struct gfs2_sbd *sdp)
+{
+       struct list_head *list = &sdp->sd_dead_glocks;
+
+       while(!list_empty(list)) {
+               struct gfs2_glock *gl;
+
+               gl = list_first_entry(list, struct gfs2_glock, gl_lru);
+               list_del_init(&gl->gl_lru);
+               __gfs2_glock_free(gl);
+       }
+}
+
 /**
  * gfs2_glock_hold() - increment reference count on glock
  * @gl: The glock to hold
@@ -2226,6 +2253,8 @@ void gfs2_gl_hash_clear(struct gfs2_sbd *sdp)
        wait_event_timeout(sdp->sd_kill_wait,
                           atomic_read(&sdp->sd_glock_disposal) == 0,
                           HZ * 600);
+       gfs2_lm_unmount(sdp);
+       gfs2_free_dead_glocks(sdp);
        glock_hash_walk(dump_glock_func, sdp);
 }
 

diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h
index 0114f3e0ebe017b898ebb7aaa56e364f3792a7ed..86987a59a05806ce681fb9452ba35e673c5260a9 100644 (file)
--- a/fs/gfs2/glock.h
+++ b/fs/gfs2/glock.h
@@ -252,6 +252,7 @@ void gfs2_gl_dq_holders(struct gfs2_sbd *sdp);
 void gfs2_glock_thaw(struct gfs2_sbd *sdp);
 void gfs2_glock_add_to_lru(struct gfs2_glock *gl);
 void gfs2_glock_free(struct gfs2_glock *gl);
+void gfs2_glock_free_later(struct gfs2_glock *gl);
 
 int __init gfs2_glock_init(void);
 void gfs2_glock_exit(void);

diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 95a334d64da2a362983a59c06a328e3fe0b75065..60abd7050c9983cd29bb80565a9c1dcb74add4bd 100644 (file)
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -838,6 +838,7 @@ struct gfs2_sbd {
        /* For quiescing the filesystem */
        struct gfs2_holder sd_freeze_gh;
        struct mutex sd_freeze_mutex;
+       struct list_head sd_dead_glocks;
 
        char sd_fsname[GFS2_FSNAME_LEN + 3 * sizeof(int) + 2];
        char sd_table_name[GFS2_FSNAME_LEN];

diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index d1ac5d0679ea6a4ac989e2eb192d5503ab6df9f5..e028e55e67d95fa483daeb9b791c9ef7f8b4d3c1 100644 (file)
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -121,6 +121,11 @@ static void gdlm_ast(void *arg)
        struct gfs2_glock *gl = arg;
        unsigned ret = gl->gl_state;
 
+       /* If the glock is dead, we only react to a dlm_unlock() reply. */
+       if (__lockref_is_dead(&gl->gl_lockref) &&
+           gl->gl_lksb.sb_status != -DLM_EUNLOCK)
+               return;
+
        gfs2_update_reply_times(gl);
        BUG_ON(gl->gl_lksb.sb_flags & DLM_SBF_DEMOTED);
 
@@ -171,6 +176,9 @@ static void gdlm_bast(void *arg, int mode)
 {
        struct gfs2_glock *gl = arg;
 
+       if (__lockref_is_dead(&gl->gl_lockref))
+               return;
+
        switch (mode) {
        case DLM_LOCK_EX:
                gfs2_glock_cb(gl, LM_ST_UNLOCKED);
@@ -291,8 +299,12 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
        int error;
 
-       if (gl->gl_lksb.sb_lkid == 0)
-               goto out_free;
+       BUG_ON(!__lockref_is_dead(&gl->gl_lockref));
+
+       if (gl->gl_lksb.sb_lkid == 0) {
+               gfs2_glock_free(gl);
+               return;
+       }
 
        clear_bit(GLF_BLOCKING, &gl->gl_flags);
        gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT);
@@ -300,13 +312,17 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
        gfs2_update_request_times(gl);
 
        /* don't want to call dlm if we've unmounted the lock protocol */
-       if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags))
-               goto out_free;
+       if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) {
+               gfs2_glock_free(gl);
+               return;
+       }
        /* don't want to skip dlm_unlock writing the lvb when lock has one */
 
        if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
-           !gl->gl_lksb.sb_lvbptr)
-               goto out_free;
+           !gl->gl_lksb.sb_lvbptr) {
+               gfs2_glock_free_later(gl);
+               return;
+       }
 
 again:
        error = dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_VALBLK,
@@ -321,10 +337,6 @@ again:
                       gl->gl_name.ln_type,
                       (unsigned long long)gl->gl_name.ln_number, error);
        }
-       return;
-
-out_free:
-       gfs2_glock_free(gl);
 }
 
 static void gdlm_cancel(struct gfs2_glock *gl)

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 1281e60be63900764f8c6c97973e057e02897a12..db0df091a6a76c82e8d73c341742dc6e4a031a74 100644 (file)
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -136,6 +136,7 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb)
        atomic_set(&sdp->sd_log_in_flight, 0);
        init_waitqueue_head(&sdp->sd_log_flush_wait);
        mutex_init(&sdp->sd_freeze_mutex);
+       INIT_LIST_HEAD(&sdp->sd_dead_glocks);
 
        return sdp;
 

diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index e5f79466340d2aa3d5eb76262e0c04b1d8cfd9d5..2d780b4701a23b387bb7fa3e0627775de2f5993b 100644 (file)
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -646,10 +646,7 @@ restart:
        gfs2_gl_hash_clear(sdp);
        truncate_inode_pages_final(&sdp->sd_aspace);
        gfs2_delete_debugfs_file(sdp);
-       /*  Unmount the locking protocol  */
-       gfs2_lm_unmount(sdp);
 
-       /*  At this point, we're through participating in the lockspace  */
        gfs2_sys_fs_del(sdp);
        free_sbd(sdp);
 }