mirror/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
db20a8925bc420eed033c5d91ff6afa74465e521
linux/fs
History
David Howells db20a8925b cachefiles: Fix race between inactivating and culling a cache object 
There's a race between cachefiles_mark_object_inactive() and
cachefiles_cull():

 (1) cachefiles_cull() can't delete a backing file until the cache object
     is marked inactive, but as soon as that's the case it's fair game.

 (2) cachefiles_mark_object_inactive() marks the object as being inactive
     and *only then* reads the i_blocks on the backing inode - but
     cachefiles_cull() might've managed to delete it by this point.

Fix this by making sure cachefiles_mark_object_inactive() gets any data it
needs from the backing inode before deactivating the object.

Without this, the following oops may occur:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000098
IP: [<ffffffffa06c5cc1>] cachefiles_mark_object_inactive+0x61/0xb0 [cachefiles]
...
CPU: 11 PID: 527 Comm: kworker/u64:4 Tainted: G          I    ------------   3.10.0-470.el7.x86_64 #1
Hardware name: Hewlett-Packard HP Z600 Workstation/0B54h, BIOS 786G4 v03.19 03/11/2011
Workqueue: fscache_object fscache_object_work_func [fscache]
task: ffff880035edaf10 ti: ffff8800b77c0000 task.ti: ffff8800b77c0000
RIP: 0010:[<ffffffffa06c5cc1>] cachefiles_mark_object_inactive+0x61/0xb0 [cachefiles]
RSP: 0018:ffff8800b77c3d70  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8800bf6cc400 RCX: 0000000000000034
RDX: 0000000000000000 RSI: ffff880090ffc710 RDI: ffff8800bf761ef8
RBP: ffff8800b77c3d88 R08: 2000000000000000 R09: 0090ffc710000000
R10: ff51005d2ff1c400 R11: 0000000000000000 R12: ffff880090ffc600
R13: ffff8800bf6cc520 R14: ffff8800bf6cc400 R15: ffff8800bf6cc498
FS:  0000000000000000(0000) GS:ffff8800bb8c0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000098 CR3: 00000000019ba000 CR4: 00000000000007e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Stack:
 ffff880090ffc600 ffff8800bf6cc400 ffff8800867df140 ffff8800b77c3db0
 ffffffffa06c48cb ffff880090ffc600 ffff880090ffc180 ffff880090ffc658
 ffff8800b77c3df0 ffffffffa085d846 ffff8800a96b8150 ffff880090ffc600
Call Trace:
 [<ffffffffa06c48cb>] cachefiles_drop_object+0x6b/0xf0 [cachefiles]
 [<ffffffffa085d846>] fscache_drop_object+0xd6/0x1e0 [fscache]
 [<ffffffffa085d615>] fscache_object_work_func+0xa5/0x200 [fscache]
 [<ffffffff810a605b>] process_one_work+0x17b/0x470
 [<ffffffff810a6e96>] worker_thread+0x126/0x410
 [<ffffffff810a6d70>] ? rescuer_thread+0x460/0x460
 [<ffffffff810ae64f>] kthread+0xcf/0xe0
 [<ffffffff810ae580>] ? kthread_create_on_node+0x140/0x140
 [<ffffffff81695418>] ret_from_fork+0x58/0x90
 [<ffffffff810ae580>] ? kthread_create_on_node+0x140/0x140

The oopsing code shows:

	callq  0xffffffff810af6a0 <wake_up_bit>
	mov    0xf8(%r12),%rax
	mov    0x30(%rax),%rax
	mov    0x98(%rax),%rax   <---- oops here
	lock add %rax,0x130(%rbx)

where this is:

	d_backing_inode(object->dentry)->i_blocks

Fixes: a5b3a80b89 (CacheFiles: Provide read-and-reset release counters for cachefilesd)
Reported-by: Jianhong Yin <jiyin@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Steve Dickson <steved@redhat.com>
cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-08-03 13:33:26 -04:00
..
9p
9p: use clone_fid()
2016-08-03 11:12:12 -04:00
adfs
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
affs
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
afs
rxrpc: Limit the listening backlog
2016-06-10 18:14:47 -07:00
autofs4
Merge branch 'salted-string-hash'
2016-07-28 12:26:31 -07:00
befs
fs/befs/io.c:befs_bread(): remove unneeded initialization to NULL
2016-05-23 17:04:14 -07:00
bfs
more trivial ->iterate_shared conversions
2016-05-09 11:41:14 -04:00
btrfs
Merge branch 'akpm' (patches from Andrew)
2016-07-26 19:55:54 -07:00
cachefiles
cachefiles: Fix race between inactivating and culling a cache object
2016-08-03 13:33:26 -04:00
ceph
Merge branch 'salted-string-hash'
2016-07-28 12:26:31 -07:00
cifs
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
coda
drop redundant ->owner initializations
2016-05-29 19:08:00 -04:00
configfs
configfs: don't set buffer_needs_fill to zero if show() returns error
2016-07-10 21:02:18 +09:00
cramfs
more trivial ->iterate_shared conversions
2016-05-09 11:41:14 -04:00
crypto
block, fs, mm, drivers: use bio set/get op accessors
2016-06-07 13:41:38 -06:00
debugfs
Merge branch 'd_real' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs into work.misc
2016-06-30 23:34:49 -04:00
devpts
devpts: Make each mount of devpts an independent filesystem.
2016-06-05 10:36:01 -07:00
dlm
dlm: Use kmemdup instead of kmalloc and memcpy
2016-06-23 11:55:58 -05:00
ecryptfs
ecryptfs: don't allow mmap when the lower fs doesn't support it
2016-07-08 10:35:28 -05:00
efivarfs
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
efs
fs/efs/super.c: fix return value
2016-05-20 17:58:30 -07:00
exofs
block, fs, mm, drivers: use bio set/get op accessors
2016-06-07 13:41:38 -06:00
exportfs
introduce a parallel variant of ->iterate()
2016-05-02 19:49:29 -04:00
ext2
Merge branch 'akpm' (patches from Andrew)
2016-07-26 19:55:54 -07:00
ext4
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-07-28 12:59:05 -07:00
f2fs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-07-28 12:59:05 -07:00
fat
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
freevxfs
freevxfs: update Kconfig information
2016-06-13 10:20:39 +02:00
fscache
Merge branch 'd_real' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs into work.misc
2016-06-30 23:34:49 -04:00
fuse
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
2016-07-29 12:29:15 -07:00
gfs2
Merge branch 'for-4.8/drivers' of git://git.kernel.dk/linux-block
2016-07-26 15:37:51 -07:00
hfs
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
hfsplus
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
hostfs
hostfs: switch to ->iterate_shared()
2016-05-12 19:49:30 -04:00
hpfs
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
hugetlbfs
mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage
2016-04-04 10:41:08 -07:00
isofs
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
jbd2
Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
2016-07-26 18:35:55 -07:00
jffs2
vfs: make the string hashes salt the hash
2016-06-10 20:21:46 -07:00
jfs
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
kernfs
vfs: make the string hashes salt the hash
2016-06-10 20:21:46 -07:00
lockd
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-07-28 12:59:05 -07:00
logfs
Merge branch 'salted-string-hash'
2016-07-28 12:26:31 -07:00
minix
simple local filesystems: switch to ->iterate_shared()
2016-05-02 19:49:32 -04:00
ncpfs
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
nfs
Merge tag 'trace-v4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
2016-07-28 18:20:09 -07:00
nfs_common
…
nfsd
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-07-28 12:59:05 -07:00
nilfs2
Merge branch 'for-4.8/core' of git://git.kernel.dk/linux-block
2016-07-26 15:03:07 -07:00
nls
…
notify
fsnotify: avoid spurious EMFILE errors from inotify_init()
2016-05-19 19:12:14 -07:00
ntfs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-07-28 12:59:05 -07:00
ocfs2
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2016-07-28 14:22:25 -07:00
omfs
more trivial ->iterate_shared conversions
2016-05-09 11:41:14 -04:00
openpromfs
more trivial ->iterate_shared conversions
2016-05-09 11:41:14 -04:00
orangefs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-07-28 12:59:05 -07:00
overlayfs
ovl: simplify empty checking
2016-07-29 12:05:25 +02:00
proc
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
pstore
pstore/ram: add Device Tree bindings
2016-06-14 11:34:39 -07:00
qnx4
more trivial ->iterate_shared conversions
2016-05-09 11:41:14 -04:00
qnx6
more trivial ->iterate_shared conversions
2016-05-09 11:41:14 -04:00
quota
quota: use time64_t internally
2016-06-19 18:09:31 +02:00
ramfs
tmpfs/ramfs: fix VM_MAYSHARE mappings for NOMMU
2016-05-20 17:58:30 -07:00
reiserfs
Merge branch 'for-4.8/drivers' of git://git.kernel.dk/linux-block
2016-07-26 15:37:51 -07:00
romfs
romfs, squashfs: switch to ->iterate_shared()
2016-05-09 11:41:15 -04:00
squashfs
fs: have ll_rw_block users pass in op and flags separately
2016-06-07 13:41:38 -06:00
sysfs
…
sysv
vfs: make the string hashes salt the hash
2016-06-10 20:21:46 -07:00
tracefs
tracefs: ->d_parent is never NULL or negative...
2016-05-29 16:22:07 -04:00
ubifs
UBIFS: Implement ->migratepage()
2016-06-23 00:29:53 +02:00
udf
Merge branch 'for-4.8/drivers' of git://git.kernel.dk/linux-block
2016-07-26 15:37:51 -07:00
ufs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-07-28 12:59:05 -07:00
xfs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-07-28 12:59:05 -07:00
aio.c
aio: make aio_setup_ring killable
2016-05-23 17:04:14 -07:00
anon_inodes.c
…
attr.c
wrappers for ->i_mutex access
2016-01-22 18:04:28 -05:00
bad_inode.c
switch ->setxattr() to passing dentry and inode separately
2016-05-27 20:09:16 -04:00
binfmt_aout.c
fs: fix binfmt_aout.c build error
2016-05-28 16:34:59 -07:00
binfmt_elf_fdpic.c
coredump: fix dumping through pipes
2016-06-07 22:07:09 -04:00
binfmt_elf.c
coredump: fix dumping through pipes
2016-06-07 22:07:09 -04:00
binfmt_em86.c
…
binfmt_flat.c
remove lots of IS_ERR_VALUE abuses
2016-05-27 15:26:11 -07:00
binfmt_misc.c
binfmt_misc: ->s_root is not going anywhere
2016-05-29 19:14:03 -04:00
binfmt_script.c
…
block_dev.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-07-28 12:59:05 -07:00
buffer.c
Merge tag 'xfs-for-linus-4.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs
2016-07-27 09:53:35 -07:00
char_dev.c
chardev: add missing line break in pr_warn
2016-07-14 16:21:53 +09:00
compat_binfmt_elf.c
…
compat_ioctl.c
[media] cec: add compat32 ioctl support
2016-06-28 10:00:13 -03:00
compat.c
Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
2016-05-24 12:55:26 -07:00
coredump.c
coredump: fix dumping through pipes
2016-06-07 22:07:09 -04:00
dax.c
Merge tag 'libnvdimm-for-4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2016-07-28 17:38:16 -07:00
dcache.c
get rid of 'parent' argument of ->d_compare()
2016-07-31 16:37:25 -04:00
dcookies.c
…
direct-io.c
direct-io: use bio set/get op accessors
2016-06-07 13:41:38 -06:00
drop_caches.c
…
eventfd.c
eventfd: document lockless access in eventfd_poll
2016-03-22 15:36:02 -07:00
eventpoll.c
fs: poll/select/recvmmsg: use timespec64 for timeout events
2016-05-19 19:12:14 -07:00
exec.c
exec: make exec path waiting for mmap_sem killable
2016-05-23 17:04:14 -07:00
fcntl.c
…
fhandle.c
fs/coredump: prevent fsuid=0 dumps into user-controlled directories
2016-03-22 15:36:02 -07:00
file_table.c
…
file.c
give readdir(2)/getdents(2)/etc. uniform exclusion with lseek()
2016-05-02 19:49:28 -04:00
filesystems.c
find_filesystem(): simplify comparison
2016-01-19 12:02:23 -05:00
fs_pin.c
…
fs_struct.c
…
fs-writeback.c
mm: move most file-based accounting to the node
2016-07-28 16:07:41 -07:00
inode.c
Merge branch 'for-viro' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs into for-linus
2016-08-03 13:31:51 -04:00
internal.h
Merge branch 'for-viro' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs into for-linus
2016-08-03 13:31:51 -04:00
ioctl.c
vfs: ioctl: prevent double-fetch in dedupe ioctl
2016-07-28 15:23:12 -07:00
iomap.c
fs: iomap based fiemap implementation
2016-06-21 09:38:45 +10:00
Kconfig
fs: introduce iomap infrastructure
2016-06-21 09:23:11 +10:00
Kconfig.binfmt
ELF/MIPS build fix
2016-05-23 17:04:14 -07:00
libfs.c
lockless next_positive()
2016-06-20 17:11:29 -04:00
locks.c
locks: use file_inode()
2016-07-01 10:24:18 -04:00
Makefile
fs: introduce iomap infrastructure
2016-06-21 09:23:11 +10:00
mbcache.c
mbcache: add reusable flag to cache entries
2016-02-22 22:44:04 -05:00
mount.h
…
mpage.c
Merge branch 'akpm' (patches from Andrew)
2016-07-26 19:55:54 -07:00
namei.c
Revert "vfs: add lookup_hash() helper"
2016-07-29 12:17:52 -07:00
namespace.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-07-01 15:20:11 -07:00
no-block.c
…
nsfs.c
…
open.c
vfs: merge .d_select_inode() into .d_real()
2016-06-30 08:53:27 +02:00
pipe.c
pipe: account to kmemcg
2016-07-26 16:19:19 -07:00
pnode.c
propogate_mnt: Handle the first propogated copy being a slave
2016-05-05 09:54:45 -05:00
pnode.h
…
posix_acl.c
posix_acl: Add set_posix_acl
2016-06-24 12:11:34 -04:00
proc_namespace.c
vfs: show_vfsstat: do not ignore errors from show_devname method
2016-03-16 13:09:08 -04:00
read_write.c
x86/syscalls: Add compat_sys_preadv64v2/compat_sys_pwritev64v2
2016-07-15 10:30:26 +02:00
readdir.c
restore killability of old mutex_lock_killable(&inode->i_mutex) users
2016-05-26 00:13:25 -04:00
select.c
fs: poll/select/recvmmsg: use timespec64 for timeout events
2016-05-19 19:12:14 -07:00
seq_file.c
Make file credentials available to the seqfile interfaces
2016-04-14 12:56:09 -07:00
signalfd.c
…
splice.c
Merge branch 'ovl-fixes' into for-linus
2016-05-11 00:00:29 -04:00
stack.c
…
stat.c
fs/stat.c: drop the last new_valid_dev check
2016-01-16 11:17:23 -08:00
statfs.c
…
super.c
fs/fs-writeback.c: add a new writeback list for sync
2016-07-26 16:19:19 -07:00
sync.c
mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros
2016-04-04 10:41:08 -07:00
timerfd.c
timerfd: Reject ALARM timerfds without CAP_WAKE_ALARM
2016-06-09 23:42:38 +02:00
userfaultfd.c
mm: introduce fault_env
2016-07-26 16:19:19 -07:00
utimes.c
wrappers for ->i_mutex access
2016-01-22 18:04:28 -05:00
xattr.c
switch ->setxattr() to passing dentry and inode separately
2016-05-27 20:09:16 -04:00