• Luis Henriques's avatar
    ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob() · c4e28be2
    Luis Henriques authored
    [ Upstream commit 12fe3dda ]
    
    Calling ceph_buffer_put() in __ceph_build_xattrs_blob() may result in
    freeing the i_xattrs.blob buffer while holding the i_ceph_lock.  This can
    be fixed by having this function returning the old blob buffer and have
    the callers of this function freeing it when the lock is released.
    
    The following backtrace was triggered by fstests generic/117.
    
      BUG: sleeping function called from invalid context at mm/vmalloc.c:2283
      in_atomic(): 1, irqs_disabled(): 0, pid: 649, name: fsstress
      4 locks held by fsstress/649:
       #0: 00000000a7478e7e (&type->s_umount_key#19){++++}, at: iterate_supers+0x77/0xf0
       #1: 00000000f8de1423 (&(&ci->i_ceph_lock)->rlock){+.+.}, at: ceph_check_caps+0x7b/0xc60
       #2: 00000000562f2b27 (&s->s_mutex){+.+.}, at: ceph_check_caps+0x3bd/0xc60
       #3: 00000000f83ce16a (&mdsc->snap_rwsem){++++}, at: ceph_check_caps+0x3ed/0xc60
      CPU: 1 PID: 649 Comm: fsstress Not tainted 5.2.0+ #439
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58-prebuilt.qemu.org 04/01/2014
      Call Trace:
       dump_stack+0x67/0x90
       ___might_sleep.cold+0x9f/0xb1
       vfree+0x4b/0x60
       ceph_buffer_release+0x1b/0x60
       __ceph_build_xattrs_blob+0x12b/0x170
       __send_cap+0x302/0x540
       ? __lock_acquire+0x23c/0x1e40
       ? __mark_caps_flushing+0x15c/0x280
       ? _raw_spin_unlock+0x24/0x30
       ceph_check_caps+0x5f0/0xc60
       ceph_flush_dirty_caps+0x7c/0x150
       ? __ia32_sys_fdatasync+0x20/0x20
       ceph_sync_fs+0x5a/0x130
       iterate_supers+0x8f/0xf0
       ksys_sync+0x4f/0xb0
       __ia32_sys_sync+0xa/0x10
       do_syscall_64+0x50/0x1c0
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x7fc6409ab617
    Signed-off-by: default avatarLuis Henriques <lhenriques@suse.com>
    Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
    Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
    Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    c4e28be2
Name
Last commit
Last update
Documentation Loading commit data...
LICENSES Loading commit data...
arch Loading commit data...
block Loading commit data...
certs Loading commit data...
crypto Loading commit data...
drivers Loading commit data...
fs Loading commit data...
include Loading commit data...
init Loading commit data...
ipc Loading commit data...
kernel Loading commit data...
lib Loading commit data...
mm Loading commit data...
net Loading commit data...
samples Loading commit data...
scripts Loading commit data...
security Loading commit data...
sound Loading commit data...
tools Loading commit data...
usr Loading commit data...
virt Loading commit data...
.clang-format Loading commit data...
.cocciconfig Loading commit data...
.get_maintainer.ignore Loading commit data...
.gitattributes Loading commit data...
.gitignore Loading commit data...
.mailmap Loading commit data...
COPYING Loading commit data...
CREDITS Loading commit data...
Kbuild Loading commit data...
Kconfig Loading commit data...
MAINTAINERS Loading commit data...
Makefile Loading commit data...
README Loading commit data...