Re: [PATCH 06/13] afs: fix __afs_break_callback() / afs_drop_open_mmap() race

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, Feb 04, 2024 at 02:17:32AM +0000, Al Viro wrote:
> In __afs_break_callback() we might check ->cb_nr_mmap and if it's non-zero
> do queue_work(&vnode->cb_work).  In afs_drop_open_mmap() we decrement
> ->cb_nr_mmap and do flush_work(&vnode->cb_work) if it reaches zero.
> 
> The trouble is, there's nothing to prevent __afs_break_callback() from
> seeing ->cb_nr_mmap before the decrement and do queue_work() after both
> the decrement and flush_work().  If that happens, we might be in trouble -
> vnode might get freed before the queued work runs.
> 
> __afs_break_callback() is always done under ->cb_lock, so let's make
> sure that ->cb_nr_mmap can change from non-zero to zero while holding
> ->cb_lock (the spinlock component of it - it's a seqlock and we don't
> need to mess with the counter).
> 
> Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> ---

Acked-by: Christian Brauner <brauner@xxxxxxxxxx>




[Index of Archives]     [Reiser Filesystem Development]     [Ceph FS]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Linux FS]     [Yosemite National Park]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Device Mapper]     [Linux Media]

  Powered by Linux