ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()

Move atomic_inc(&ocfs2_control_opened) and the handshake state update
inside ocfs2_control_lock to close a race window where
ocfs2_control_release() can observe ocfs2_control_opened dropping to zero
(resetting ocfs2_control_this_node and running_proto) while
ocfs2_control_install_private() is about to bump the counter and mark the
connection valid.

Link: https://lore.kernel.org/20260601121618.1263346-1-joseph.qi@linux.alibaba.com
Fixes: 3cfd4ab6b6b4 ("ocfs2: Add the local node id to the handshake.")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reported-by: Ginger <ginger.jzllee@gmail.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index 5803f1dee6790d03d98d8bf815d7b401ccf4e53e..91e19d33847c19f8b1050f8caa68521be154169f 100644 (file)
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -327,18 +327,14 @@ static int ocfs2_control_install_private(struct file *file)
                ocfs2_control_this_node = p->op_this_node;
                running_proto.pv_major = p->op_proto.pv_major;
                running_proto.pv_minor = p->op_proto.pv_minor;
-       }
-
-out_unlock:
-       mutex_unlock(&ocfs2_control_lock);
-
-       if (!rc && set_p) {
-               /* We set the global values successfully */
                atomic_inc(&ocfs2_control_opened);
                ocfs2_control_set_handshake_state(file,
                                        OCFS2_CONTROL_HANDSHAKE_VALID);
        }
 
+out_unlock:
+       mutex_unlock(&ocfs2_control_lock);
+
        return rc;
 }