Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Junxiao Bi via Ocfs2-devel 1434cd71ad ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock ... commit 863e0d81b6683c4cbc588ad831f560c90e494bef upstream. When user_dlm_destroy_lock failed, it didn't clean up the flags it set before exit. For USER_LOCK_IN_TEARDOWN, if this function fails because of lock is still in used, next time when unlink invokes this function, it will return succeed, and then unlink will remove inode and dentry if lock is not in used(file closed), but the dlm lock is still linked in dlm lock resource, then when bast come in, it will trigger a panic due to user-after-free. See the following panic call trace. To fix this, USER_LOCK_IN_TEARDOWN should be reverted if fail. And also error should be returned if USER_LOCK_IN_TEARDOWN is set to let user know that unlink fail. For the case of ocfs2_dlm_unlock failure, besides USER_LOCK_IN_TEARDOWN, USER_LOCK_BUSY is also required to be cleared. Even though spin lock is released in between, but USER_LOCK_IN_TEARDOWN is still set, for USER_LOCK_BUSY, if before every place that waits on this flag, USER_LOCK_IN_TEARDOWN is checked to bail out, that will make sure no flow waits on the busy flag set by user_dlm_destroy_lock(), then we can simplely revert USER_LOCK_BUSY when ocfs2_dlm_unlock fails. Fix user_dlm_cluster_lock() which is the only function not following this. [ 941.336392] (python,26174,16):dlmfs_unlink:562 ERROR: unlink 004fb0000060000b5a90b8c847b72e1, error -16 from destroy [ 989.757536] ------------[ cut here ]------------ [ 989.757709] kernel BUG at fs/ocfs2/dlmfs/userdlm.c:173! [ 989.757876] invalid opcode: 0000 [#1] SMP [ 989.758027] Modules linked in: ksplice_2zhuk2jr_ib_ipoib_new(O) ksplice_2zhuk2jr(O) mptctl mptbase xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn cdc_ether usbnet mii ocfs2 jbd2 rpcsec_gss_krb5 auth_rpcgss nfsv4 nfsv3 nfs_acl nfs fscache lockd grace ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc scsi_transport_fc sunrpc ipmi_devintf bridge stp llc rds_rdma rds bonding ib_sdp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm falcon_lsm_serviceable(PE) falcon_nf_netcontain(PE) mlx4_vnic falcon_kal(E) falcon_lsm_pinned_13402(E) mlx4_ib ib_sa ib_mad ib_core ib_addr xenfs xen_privcmd dm_multipath iTCO_wdt iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 lpc_ich mfd_core ipmi_ssif i2c_core ipmi_si ipmi_msghandler [ 989.760686] ioatdma sg ext3 jbd mbcache sd_mod ahci libahci ixgbe dca ptp pps_core vxlan udp_tunnel ip6_udp_tunnel megaraid_sas mlx4_core crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi wmi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ksplice_2zhuk2jr_ib_ipoib_old] [ 989.761987] CPU: 10 PID: 19102 Comm: dlm_thread Tainted: P OE 4.1.12-124.57.1.el6uek.x86_64 #2 [ 989.762290] Hardware name: Oracle Corporation ORACLE SERVER X5-2/ASM,MOTHERBOARD,1U, BIOS 30350100 06/17/2021 [ 989.762599] task: ffff880178af6200 ti: ffff88017f7c8000 task.ti: ffff88017f7c8000 [ 989.762848] RIP: e030:[<ffffffffc07d4316>] [<ffffffffc07d4316>] __user_dlm_queue_lockres.part.4+0x76/0x80 [ocfs2_dlmfs] [ 989.763185] RSP: e02b:ffff88017f7cbcb8 EFLAGS: 00010246 [ 989.763353] RAX: 0000000000000000 RBX: ffff880174d48008 RCX: 0000000000000003 [ 989.763565] RDX: 0000000000120012 RSI: 0000000000000003 RDI: ffff880174d48170 [ 989.763778] RBP: ffff88017f7cbcc8 R08: ffff88021f4293b0 R09: 0000000000000000 [ 989.763991] R10: ffff880179c8c000 R11: 0000000000000003 R12: ffff880174d48008 [ 989.764204] R13: 0000000000000003 R14: ffff880179c8c000 R15: ffff88021db7a000 [ 989.764422] FS: 0000000000000000(0000) GS:ffff880247480000(0000) knlGS:ffff880247480000 [ 989.764685] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 989.764865] CR2: ffff8000007f6800 CR3: 0000000001ae0000 CR4: 0000000000042660 [ 989.765081] Stack: [ 989.765167] 0000000000000003 ffff880174d48040 ffff88017f7cbd18 ffffffffc07d455f [ 989.765442] ffff88017f7cbd88 ffffffff816fb639 ffff88017f7cbd38 ffff8800361b5600 [ 989.765717] ffff88021db7a000 ffff88021f429380 0000000000000003 ffffffffc0453020 [ 989.765991] Call Trace: [ 989.766093] [<ffffffffc07d455f>] user_bast+0x5f/0xf0 [ocfs2_dlmfs] [ 989.766287] [<ffffffff816fb639>] ? schedule_timeout+0x169/0x2d0 [ 989.766475] [<ffffffffc0453020>] ? o2dlm_lock_ast_wrapper+0x20/0x20 [ocfs2_stack_o2cb] [ 989.766738] [<ffffffffc045303a>] o2dlm_blocking_ast_wrapper+0x1a/0x20 [ocfs2_stack_o2cb] [ 989.767010] [<ffffffffc0864ec6>] dlm_do_local_bast+0x46/0xe0 [ocfs2_dlm] [ 989.767217] [<ffffffffc084f5cc>] ? dlm_lockres_calc_usage+0x4c/0x60 [ocfs2_dlm] [ 989.767466] [<ffffffffc08501f1>] dlm_thread+0xa31/0x1140 [ocfs2_dlm] [ 989.767662] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.767834] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.768006] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.768178] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.768349] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.768521] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.768693] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.768893] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.769067] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.769241] [<ffffffff810ce4d0>] ? wait_woken+0x90/0x90 [ 989.769411] [<ffffffffc084f7c0>] ? dlm_kick_thread+0x80/0x80 [ocfs2_dlm] [ 989.769617] [<ffffffff810a8bbb>] kthread+0xcb/0xf0 [ 989.769774] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.769945] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.770117] [<ffffffff810a8af0>] ? kthread_create_on_node+0x180/0x180 [ 989.770321] [<ffffffff816fdaa1>] ret_from_fork+0x61/0x90 [ 989.770492] [<ffffffff810a8af0>] ? kthread_create_on_node+0x180/0x180 [ 989.770689] Code: d0 00 00 00 f0 45 7d c0 bf 00 20 00 00 48 89 83 c0 00 00 00 48 89 83 c8 00 00 00 e8 55 c1 8c c0 83 4b 04 10 48 83 c4 08 5b 5d c3 <0f> 0b 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 55 41 54 53 48 83 [ 989.771892] RIP [<ffffffffc07d4316>] __user_dlm_queue_lockres.part.4+0x76/0x80 [ocfs2_dlmfs] [ 989.772174] RSP <ffff88017f7cbcb8> [ 989.772704] ---[ end trace ebd1e38cebcc93a8 ]--- [ 989.772907] Kernel panic - not syncing: Fatal exception [ 989.773173] Kernel Offset: disabled Link: https://lkml.kernel.org/r/20220518235224.87100-2-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Joseph Qi <jiangqi903@gmail.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Gang He <ghe@suse.com> Cc: Jun Piao <piaojun@huawei.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-06-14 16:52:34 +02:00
..
9p	9P: Cast to loff_t before multiplying	2020-11-10 10:23:59 +01:00
adfs	fs/adfs: super: fix use-after-free bug	2019-08-06 18:29:35 +02:00
affs	affs: fix basic permission bits to actually work	2020-09-12 11:47:39 +02:00
afs	afs: Fix large file support	2020-01-29 10:24:34 +01:00
autofs4	autofs: fix a leak in autofs_expire_indirect()	2019-12-21 10:40:46 +01:00
befs
bfs	bfs: add sanity check at bfs_fill_super()	2018-12-01 09:44:19 +01:00
btrfs	btrfs: add "0x" prefix for unsupported optional features	2022-06-14 16:52:28 +02:00
cachefiles	cachefiles: Handle readpage error correctly	2020-11-10 10:24:00 +01:00
ceph	ceph: lockdep annotations for try_nonblocking_invalidate	2021-09-26 13:36:18 +02:00
cifs	cifs: Check the IOCB_DIRECT flag, not O_DIRECT	2022-04-27 13:14:11 +02:00
coda	coda: add error handling for fget	2019-08-06 18:29:38 +02:00
configfs	configfs: fix a race in configfs_{,un}register_subsystem()	2022-03-02 11:32:03 +01:00
cramfs	Cramfs: fix abad comparison when wrap-arounds occur	2018-11-13 11:17:03 -08:00
crypto	fscrypt: don't ignore minor_hash when hash is 0	2021-07-20 16:21:11 +02:00
debugfs	debugfs: fix use-after-free on symlink traversal	2019-05-08 07:19:10 +02:00
devpts	fs/devpts: always delete dcache dentry-s in dput()	2019-03-23 13:19:47 +01:00
dlm	dlm: fix missing lkb refcount handling	2022-06-14 16:52:34 +02:00
ecryptfs	Revert "ecryptfs: replace BUG_ON with error handling code"	2021-05-26 11:29:07 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-12-02 08:31:28 +01:00
efs
exofs	fs/exofs: fix potential memory leak in mount option parsing	2018-11-27 16:09:38 +01:00
exportfs	exportfs: fix 'passing zero to ERR_PTR()' warning	2020-01-29 10:24:03 +01:00
ext2	ext2: correct max file size computing	2022-04-20 09:06:35 +02:00
ext4	ext4: verify dir block before splitting it	2022-06-14 16:52:34 +02:00
f2fs	f2fs: fix a redundant call to f2fs_balance_fs if an error occurs	2021-05-22 10:40:30 +02:00
fat	fat: add ratelimit to fat*_ent_bread()	2022-06-14 16:52:30 +02:00
freevxfs
fscache	fscache: fix race between enablement and dropping of object	2018-12-17 09:38:34 +01:00
fuse	fuse: fix live lock in fuse_iget()	2022-01-27 08:47:40 +01:00
gfs2	gfs2: assign rgrp glock before compute_bitstructs	2022-04-27 13:14:10 +02:00
hfs	hfs: add lock nesting notation to hfs_find_init	2021-08-04 11:58:02 +02:00
hfsplus	hfsplus: fix crash and filesystem corruption when deleting files	2020-04-24 07:58:59 +02:00
hostfs
hpfs
hugetlbfs	hugetlbfs: hugetlb_fault_mutex_hash() cleanup	2021-06-03 08:23:33 +02:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-11-12 13:18:02 +01:00
jbd2	jbd2: abort journal if free a async write error metadata buffer	2020-09-03 11:21:19 +02:00
jffs2	jffs2: fix memory leak in jffs2_scan_medium	2022-04-20 09:06:29 +02:00
jfs	fs: jfs: fix possible NULL pointer dereference in dbFree()	2022-06-14 16:52:30 +02:00
kernfs	kernfs: Fix range checks in kernfs_get_target_path	2019-11-25 09:52:23 +01:00
lockd	lockd: don't use interval-based rebinding over TCP	2020-12-29 13:44:57 +01:00
logfs
minix	fs/minix: reject too-large maximum file size	2020-08-21 11:02:06 +02:00
ncpfs	ncpfs: fix build warning of strncpy	2019-03-13 14:04:52 -07:00
nfs	NFS: remove unneeded check in decode_devicenotify_args()	2022-04-20 09:06:37 +02:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-29 13:44:59 +01:00
nfsd	NFSD: Fix possible sleep during nfsd4_release_lockowner()	2022-06-06 08:19:46 +02:00
nilfs2	nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group	2021-09-26 13:36:19 +02:00
nls
notify	inotify: show inotify mask flags in proc fdinfo	2022-06-14 16:52:31 +02:00
ntfs	ntfs: add sanity check on allocation size	2022-04-20 09:06:38 +02:00
ocfs2	ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock	2022-06-14 16:52:34 +02:00
omfs
openpromfs
orangefs	fs: orangefs: fix error return code of orangefs_revalidate_lookup()	2021-11-26 11:48:38 +01:00
overlayfs	ovl: fix missing negative dentry check in ovl_rename()	2021-10-17 10:05:38 +02:00
proc	proc/vmcore: fix clearing user buffer by properly using clear_user()	2021-12-08 08:45:04 +01:00
pstore	pstore/ram: Write new dumps to start of recycled zones	2020-01-12 11:24:20 +01:00
qnx4	qnx4: work around gcc false positive warning bug	2021-10-06 10:23:41 +02:00
qnx6
quota	quota: make dquot_quota_sync return errors from ->sync_fs	2022-02-23 11:56:39 +01:00
ramfs
reiserfs	reiserfs: check directory items on read from disk	2021-08-15 13:01:04 +02:00
romfs	romfs: fix uninitialized memory leak in romfs_dev_read()	2020-08-26 10:29:03 +02:00
squashfs	squashfs: fix divide error in calculate_skip()	2021-05-22 10:40:32 +02:00
sysfs	fs: sysfs_emit: Remove PAGE_SIZE alignment check	2022-03-23 09:00:34 +01:00
sysv	sysv: return 'err' instead of 0 in __sysv_write_inode	2018-12-17 09:38:32 +01:00
tracefs	tracefs: Set the group ownership in apply_options() not parse_options()	2022-03-02 11:32:05 +01:00
ubifs	ubifs: setflags: Make dirtied_ino_d 8 bytes aligned	2022-04-20 09:06:40 +02:00
udf	udf: Fix NULL ptr deref when converting from inline format	2022-02-08 18:15:26 +01:00
ufs	fs/ufs: avoid potential u32 multiplication overflow	2020-08-21 11:02:11 +02:00
xfs	xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate	2022-01-11 13:38:12 +01:00
aio.c	aio: fix spectre gadget in lookup_ioctx	2018-12-21 14:11:31 +01:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf.c	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()	2020-06-03 08:16:42 +02:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c	fs/binfmt_flat.c: make load_flat_shared_library() work	2019-07-10 09:55:38 +02:00
binfmt_misc.c	binfmt_misc: fix possible deadlock in bm_register_write	2021-03-17 16:10:18 +01:00
binfmt_script.c	exec: load_script: Do not exec truncated interpreter path	2019-11-06 12:18:04 +01:00
block_dev.c	bdev: Reduce time holding bd_mutex in sync in blkdev_close()	2020-10-01 20:40:12 +02:00
buffer.c	fs: Don't invalidate page buffers in block_write_full_page()	2020-11-10 10:23:56 +01:00
char_dev.c	chardev: add helper function to register char devs with a struct device	2020-05-20 08:15:32 +02:00
compat.c
compat_binfmt_elf.c	binfmt_elf: compat: avoid unused function warning	2018-02-25 11:05:55 +01:00
compat_ioctl.c	media: dvb_frontend: Add compat_ioctl callback	2020-06-30 15:38:35 -04:00
coredump.c	coredump: Ensure proper size of sparse core files	2017-07-05 14:40:26 +02:00
dax.c	fs/dax.c: fix inefficiency in dax_writeback_mapping_range()	2018-02-28 10:18:33 +01:00
dcache.c	Hang/soft lockup in d_invalidate with simultaneous calls	2019-03-27 14:13:04 +09:00
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-16 11:59:07 +02:00
drop_caches.c	fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()	2019-03-13 14:04:58 -07:00
eventfd.c
eventpoll.c	ep_create_wakeup_source(): dentry name can change under you...	2020-10-14 09:48:13 +02:00
exec.c	exec: Force single empty string when argv is empty	2022-06-06 08:19:46 +02:00
fcntl.c	fs/fcntl: f_setown, avoid undefined behaviour	2018-01-31 12:55:52 +01:00
fhandle.c
file.c	fget: clarify and improve __fget_files() implementation	2022-03-02 11:32:07 +01:00
file_table.c	fs: add fget_many() and fput_many()	2021-12-08 08:45:06 +01:00
filesystems.c
fs-writeback.c	fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages	2022-06-14 16:52:34 +02:00
fs_pin.c
fs_struct.c
inode.c	futex: Fix inode life-time issue	2020-04-02 17:20:27 +02:00
internal.h	xfs: evict all inodes involved with log redo item	2017-09-20 08:20:01 +02:00
ioctl.c
iomap.c	iomap: fix integer truncation issues in the zeroing and dirtying helpers	2017-09-20 08:19:59 +02:00
Kconfig
Kconfig.binfmt
libfs.c	libfs: fix error cast of negative value in simple_attr_write()	2020-11-24 13:03:05 +01:00
locks.c	locks: print unsigned ino in /proc/locks	2020-01-12 11:24:13 +01:00
Makefile
mbcache.c	mbcache: initialize entry->e_referenced in mb_cache_entry_create()	2018-02-22 15:43:48 +01:00
mount.h	mnt: In propgate_umount handle visiting mounts in any order	2017-07-21 07:42:22 +02:00
mpage.c	fs/mpage.c: fix mpage_writepage() for pages with buffers	2017-10-18 09:35:39 +02:00
namei.c	namei: only return -ECHILD from follow_dotdot_rcu()	2020-03-11 07:53:07 +01:00
namespace.c	fs: warn about impending deprecation of mandatory locks	2021-08-26 08:37:29 -04:00
no-block.c
nsfs.c	nsfs: mark dentry with DCACHE_RCUACCESS	2018-02-17 13:21:15 +01:00
open.c	cifs_atomic_open(): fix double-put on late allocation failure	2020-03-20 09:07:44 +01:00
pipe.c	pipe: increase minimum default pipe size to 2 pages	2021-08-15 13:01:03 +02:00
pnode.c	propagate_one(): mnt_set_mountpoint() needs mount_lock	2020-05-02 17:23:20 +02:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c	fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock	2019-06-11 12:22:49 +02:00
readdir.c	filldir[64]: remove WARN_ON_ONCE() for bad directory entries	2020-01-04 13:41:06 +01:00
select.c	kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()	2021-03-24 10:59:25 +01:00
seq_file.c	seq_file: disallow extremely large seq buffer allocations	2021-07-20 16:21:16 +02:00
signalfd.c	signalfd: use wake_up_pollfree()	2021-12-14 10:04:48 +01:00
splice.c	fs: prevent page refcount overflow in pipe_buf_get	2019-06-11 12:22:45 +02:00
stack.c
stat.c	ufs: restore maintaining ->i_blocks	2017-06-14 15:06:01 +02:00
statfs.c
super.c	vfs: make freeze_super abort when sync_filesystem returns error	2022-02-23 11:56:39 +01:00
sync.c
timerfd.c	timerfd: Protect the might cancel mechanism proper	2017-05-08 07:47:54 +02:00
userfaultfd.c	userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx	2019-09-06 10:19:37 +02:00
utimes.c
xattr.c	xattr: break delegations in {set,remove}xattr	2020-08-21 11:01:55 +02:00