Subject: + ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix.patch added to -mm tree To: dan.carpenter@xxxxxxxxxx,jeff.liu@xxxxxxxxxx,jlbec@xxxxxxxxxxxx,mfasheh@xxxxxxxx,yp.fangdong@xxxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Thu, 08 Aug 2013 15:22:18 -0700 The patch titled Subject: ocfs2: fix up some NULL dereference bugs has been added to the -mm tree. Its filename is ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Subject: ocfs2: fix up some NULL dereference bugs The recent -mm patch 4bce37c3e3 "ocfs2: use list_for_each_entry() instead of list_for_each()" introduced some NULL dereference bugs and also a use after free bug in dlm_clean_master_list(). Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Cc: Dong Fang <yp.fangdong@xxxxxxxxx> Cc: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Cc: Mark Fasheh <mfasheh@xxxxxxxx> Cc: Joel Becker <jlbec@xxxxxxxxxxxx> Cc: Jeff Liu <jeff.liu@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/ocfs2/dlm/dlmconvert.c | 9 +++++---- fs/ocfs2/dlm/dlmdomain.c | 15 +++++++-------- fs/ocfs2/dlm/dlmmaster.c | 3 ++- 3 files changed, 14 insertions(+), 13 deletions(-) diff -puN fs/ocfs2/dlm/dlmconvert.c~ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix fs/ocfs2/dlm/dlmconvert.c --- a/fs/ocfs2/dlm/dlmconvert.c~ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix +++ a/fs/ocfs2/dlm/dlmconvert.c @@ -422,6 +422,7 @@ int dlm_convert_lock_handler(struct o2ne struct dlm_convert_lock *cnv = (struct dlm_convert_lock *)msg->buf; struct dlm_lock_resource *res = NULL; struct dlm_lock *lock = NULL; + struct dlm_lock *tmp_lock; struct dlm_lockstatus *lksb; enum dlm_status status = DLM_NORMAL; u32 flags; @@ -467,13 +468,13 @@ int dlm_convert_lock_handler(struct o2ne dlm_error(status); goto leave; } - list_for_each_entry(lock, &res->granted, list) { - if (lock->ml.cookie == cnv->cookie && - lock->ml.node == cnv->node_idx) { + list_for_each_entry(tmp_lock, &res->granted, list) { + if (tmp_lock->ml.cookie == cnv->cookie && + tmp_lock->ml.node == cnv->node_idx) { + lock = tmp_lock; dlm_lock_get(lock); break; } - lock = NULL; } spin_unlock(&res->spinlock); if (!lock) { diff -puN fs/ocfs2/dlm/dlmdomain.c~ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix fs/ocfs2/dlm/dlmdomain.c --- a/fs/ocfs2/dlm/dlmdomain.c~ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix +++ a/fs/ocfs2/dlm/dlmdomain.c @@ -260,7 +260,7 @@ struct dlm_lock_resource * dlm_lookup_lo static struct dlm_ctxt * __dlm_lookup_domain_full(const char *domain, int len) { - struct dlm_ctxt *tmp = NULL; + struct dlm_ctxt *tmp; assert_spin_locked(&dlm_domain_lock); @@ -269,11 +269,10 @@ static struct dlm_ctxt * __dlm_lookup_do list_for_each_entry(tmp, &dlm_domains, list) { if (strlen(tmp->name) == len && memcmp(tmp->name, domain, len)==0) - break; - tmp = NULL; + return tmp; } - return tmp; + return NULL; } /* For null terminated domain strings ONLY */ @@ -362,22 +361,22 @@ static void __dlm_get(struct dlm_ctxt *d * you shouldn't trust your pointer. */ struct dlm_ctxt *dlm_grab(struct dlm_ctxt *dlm) { - struct dlm_ctxt *target = NULL; + struct dlm_ctxt *target; + struct dlm_ctxt *ret = NULL; spin_lock(&dlm_domain_lock); list_for_each_entry(target, &dlm_domains, list) { if (target == dlm) { __dlm_get(target); + ret = target; break; } - - target = NULL; } spin_unlock(&dlm_domain_lock); - return target; + return ret; } int dlm_domain_fully_joined(struct dlm_ctxt *dlm) diff -puN fs/ocfs2/dlm/dlmmaster.c~ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix fs/ocfs2/dlm/dlmmaster.c --- a/fs/ocfs2/dlm/dlmmaster.c~ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix +++ a/fs/ocfs2/dlm/dlmmaster.c @@ -3180,6 +3180,7 @@ void dlm_clean_master_list(struct dlm_ct struct dlm_master_list_entry *mle; struct dlm_lock_resource *res; struct hlist_head *bucket; + struct hlist_node *tmp; unsigned int i; mlog(0, "dlm=%s, dead node=%u\n", dlm->name, dead_node); @@ -3190,7 +3191,7 @@ top: spin_lock(&dlm->master_lock); for (i = 0; i < DLM_HASH_BUCKETS; i++) { bucket = dlm_master_hash(dlm, i); - hlist_for_each_entry(mle, bucket, master_hash_node) { + hlist_for_each_entry_safe(mle, tmp, bucket, master_hash_node) { BUG_ON(mle->type != DLM_MLE_BLOCK && mle->type != DLM_MLE_MASTER && mle->type != DLM_MLE_MIGRATION); _ Patches currently in -mm which might be from dan.carpenter@xxxxxxxxxx are ocfs2-fix-null-pointer-dereference-in-ocfs2_dir_foreach_blk_id-fix.patch ocfs2-use-list_for_each_entry-instead-of-list_for_each.patch ocfs2-use-list_for_each_entry-instead-of-list_for_each-fix.patch pktcdvd-convert-printk-to-pr_level.patch pktcdvd-fix-defective-misuses-of-pkt_level.patch linux-next.patch fs-convert-fs-shrinkers-to-new-scan-count-api-fix-fix.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html