cachefiles_read_waiter() owns a reference to a 'monitor' object and adds the object to a 'to_do' list *before* calling fscache_enqueue_retrieval() on it. The reference is passed to the to_do list, so cachefiles_read_waiter() no longer owns a reference and shouldn't be accessing the monitor. cachefiles_read_copier(), which handles the to_do list, might call fscache_put_retrieval() *before* fscache_enqueue_retrieval() takes its own reference. This can result in fscache_put_retrieval() trying to discard the op twice, which triggers an assertion failure, and can result in freed memory be accessed. The former looks like: FS-Cache: FS-Cache: Assertion failed FS-Cache: 6 == 5 is false ------------[ cut here ]------------ kernel BUG at fs/fscache/operation.c:494! A previous patch from Lei Xue moved the fscache_enqueue_retrieval() call inside the spin_locked region. I think it is cleaner to move it before. Reported-by: Lei Xue <carmark.dlut@xxxxxxxxx> Reported-by: Vegard Nossum <vegard.nossum@xxxxxxxxx> Reported-by: Anthony DeRobertis <aderobertis@xxxxxxxxxxx> Signed-off-by: NeilBrown <neilb@xxxxxxxx> --- hi Andrew, this issue was first mentioned in https://lkml.org/lkml/2018/2/22/82 in February, but David Howells doesn't seem to have responded. Can you take the patch? Thanks, NeilBrown fs/cachefiles/rdwr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c index 5082c8a49686..553a71a2c9cb 100644 --- a/fs/cachefiles/rdwr.c +++ b/fs/cachefiles/rdwr.c @@ -56,11 +56,12 @@ static int cachefiles_read_waiter(wait_queue_entry_t *wait, unsigned mode, object = container_of(monitor->op->op.object, struct cachefiles_object, fscache); + fscache_enqueue_retrieval(monitor->op); + spin_lock(&object->work_lock); list_add_tail(&monitor->op_link, &monitor->op->to_do); spin_unlock(&object->work_lock); - fscache_enqueue_retrieval(monitor->op); return 0; } -- 2.14.0.rc0.dirty
Attachment:
signature.asc
Description: PGP signature
-- Linux-cachefs mailing list Linux-cachefs@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/linux-cachefs
