On 10/1/23 9:33 PM, Al Viro wrote:
in RCU mode we might race with gfs2_evict_inode(), which zeroes ->i_gl. Freeing of the object it points to is RCU-delayed, so if we manage to fetch the pointer before it's been replaced with NULL, we are fine. Check if we'd fetched NULL and treat that as "bail out and tell the caller to get out of RCU mode". Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx> --- fs/gfs2/inode.c | 6 ++++-- fs/gfs2/super.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c index 0eac04507904..e2432c327599 100644 --- a/fs/gfs2/inode.c +++ b/fs/gfs2/inode.c @@ -1868,14 +1868,16 @@ int gfs2_permission(struct mnt_idmap *idmap, struct inode *inode, { struct gfs2_inode *ip; struct gfs2_holder i_gh; + struct gfs2_glock *gl; int error;gfs2_holder_mark_uninitialized(&i_gh);ip = GFS2_I(inode); - if (gfs2_glock_is_locked_by_me(ip->i_gl) == NULL) { + gl = rcu_dereference(ip->i_gl); + if (!gl || gfs2_glock_is_locked_by_me(gl) == NULL) {
This looks wrong. It should be if (gl && ... otherwise the gfs2_glock_nq_init will dereference the null pointer.
Bob Peterson
