Hillf Danton 094bf5670e gfs2: Fix use-after-free in gfs2_glock_shrink_scan
[ Upstream commit 1ab19c5de4c537ec0d9b21020395a5b5a6c059b2 ]

The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to
remove the glock from the lru list in __gfs2_glock_put().

On the shrink scan path, the same flag is cleared under lru_lock but because
of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the
put side can be made without deleting the glock from the lru list.

Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to
ensure correct behavior on both sides - clear GLF_LRU after list_del under
lru_lock.

Reported-by: syzbot <syzbot+34ba7ddbf3021981a228@syzkaller.appspotmail.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-30 08:48:11 -04:00
..
2018-07-02 16:27:17 +01:00
2020-05-20 08:18:41 +02:00
2018-06-04 07:56:51 -05:00
2018-07-25 00:08:59 +02:00
2018-02-01 11:25:31 -07:00
2018-01-23 07:38:53 -07:00
2018-07-25 00:06:24 +02:00
2018-07-05 17:47:16 +02:00
2018-06-21 07:39:44 -05:00
2018-08-03 13:20:02 +01:00