lkml.org 
[lkml]   [2019]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: KASAN: use-after-free Read in path_lookupat
    On Tue 26-03-19 04:15:10, Al Viro wrote:
    > On Mon, Mar 25, 2019 at 08:18:25PM -0700, Mark Fasheh wrote:
    >
    > > Hey Al,
    > >
    > > It's been a while since I've looked at that bit of code but it looks like
    > > Ocfs2 is syncing the inode to disk and disposing of it's memory
    > > representation (which would include the cluster locks held) so that other
    > > nodes get a chance to delete the potentially orphaned inode. In Ocfs2 we
    > > won't delete an inode if it exists in another nodes cache.
    >
    > Wait a sec - what's the reason for forcing that write_inode_now(); why
    > doesn't the normal mechanism work? I'm afraid I still don't get it -
    > we do wait for writeback in evict_inode(), or the local filesystems
    > wouldn't work.

    I'm just guessing here but they don't want an inode cached once its last
    dentry goes away (it makes cluster wide synchronization easier for them and
    they do play tricks with cluster lock on dentries). There is some info in
    513e2dae9422 "ocfs2: flush inode data to disk and free inode when i_count
    becomes zero" which adds this ocfs2_drop_inode() implementation. So when
    the last inode reference is dropped, they want to flush any dirty data to
    disk and evict the inode. But AFAICT they should be fine with flushing the
    inode from their ->evict_inode method. I_FREEING just stops the flusher
    thread from touching the inode but explicit writeback through
    write_inode_now(inode, 1) should go through just fine.

    Honza
    --
    Jan Kara <jack@suse.com>
    SUSE Labs, CR

    \
     
     \ /
      Last update: 2019-03-27 17:58    [W:4.430 / U:0.152 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site