lkml.org 
[lkml]   [2021]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 026/125] ocfs2: fix race between searching chunks and release journal_head from buffer_head
    Date
    From: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>

    commit 6f1b228529ae49b0f85ab89bcdb6c365df401558 upstream.

    Encountered a race between ocfs2_test_bg_bit_allocatable() and
    jbd2_journal_put_journal_head() resulting in the below vmcore.

    PID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: "loop3"
    Call trace:
    panic
    oops_end
    no_context
    __bad_area_nosemaphore
    bad_area_nosemaphore
    __do_page_fault
    do_page_fault
    page_fault
    [exception RIP: ocfs2_block_group_find_clear_bits+316]
    ocfs2_block_group_find_clear_bits [ocfs2]
    ocfs2_cluster_group_search [ocfs2]
    ocfs2_search_chain [ocfs2]
    ocfs2_claim_suballoc_bits [ocfs2]
    __ocfs2_claim_clusters [ocfs2]
    ocfs2_claim_clusters [ocfs2]
    ocfs2_local_alloc_slide_window [ocfs2]
    ocfs2_reserve_local_alloc_bits [ocfs2]
    ocfs2_reserve_clusters_with_limit [ocfs2]
    ocfs2_reserve_clusters [ocfs2]
    ocfs2_lock_refcount_allocators [ocfs2]
    ocfs2_make_clusters_writable [ocfs2]
    ocfs2_replace_cow [ocfs2]
    ocfs2_refcount_cow [ocfs2]
    ocfs2_file_write_iter [ocfs2]
    lo_rw_aio
    loop_queue_work
    kthread_worker_fn
    kthread
    ret_from_fork

    When ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the
    bg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and
    released the jounal head from the buffer head. Needed to take bit lock
    for the bit 'BH_JournalHead' to fix this race.

    Link: https://lkml.kernel.org/r/1634820718-6043-1-git-send-email-gautham.ananthakrishna@oracle.com
    Signed-off-by: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>
    Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
    Cc: <rajesh.sivaramasubramaniom@oracle.com>
    Cc: Mark Fasheh <mark@fasheh.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Junxiao Bi <junxiao.bi@oracle.com>
    Cc: Changwei Ge <gechangwei@live.cn>
    Cc: Gang He <ghe@suse.com>
    Cc: Jun Piao <piaojun@huawei.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/ocfs2/suballoc.c | 22 +++++++++++++---------
    1 file changed, 13 insertions(+), 9 deletions(-)

    --- a/fs/ocfs2/suballoc.c
    +++ b/fs/ocfs2/suballoc.c
    @@ -1251,7 +1251,7 @@ static int ocfs2_test_bg_bit_allocatable
    {
    struct ocfs2_group_desc *bg = (struct ocfs2_group_desc *) bg_bh->b_data;
    struct journal_head *jh;
    - int ret;
    + int ret = 1;

    if (ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap))
    return 0;
    @@ -1259,14 +1259,18 @@ static int ocfs2_test_bg_bit_allocatable
    if (!buffer_jbd(bg_bh))
    return 1;

    - jh = bh2jh(bg_bh);
    - spin_lock(&jh->b_state_lock);
    - bg = (struct ocfs2_group_desc *) jh->b_committed_data;
    - if (bg)
    - ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap);
    - else
    - ret = 1;
    - spin_unlock(&jh->b_state_lock);
    + jbd_lock_bh_journal_head(bg_bh);
    + if (buffer_jbd(bg_bh)) {
    + jh = bh2jh(bg_bh);
    + spin_lock(&jh->b_state_lock);
    + bg = (struct ocfs2_group_desc *) jh->b_committed_data;
    + if (bg)
    + ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap);
    + else
    + ret = 1;
    + spin_unlock(&jh->b_state_lock);
    + }
    + jbd_unlock_bh_journal_head(bg_bh);

    return ret;
    }

    \
     
     \ /
      Last update: 2021-11-01 10:42    [W:4.255 / U:0.228 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site