[lvc-project] [PATCH] gfs2: lock glock before dumping consistency errors

[Fedor Pchelkin]

On Tue, 09. Jun 20:56, Alexey Nepomnyashih wrote:
> gfs2_dump_glock() walks the glock holder list and dump_holder()
> dereferences holder fields, including the owner pid. The holder list is
> protected by gl->gl_lockref.lock, but the consistency error paths call
> gfs2_dump_glock() without taking that lock.
> 
> This can race with holder removal or reinitialization and make
> dump_holder() operate on a stale holder.
> 
>   Thread 1                         Thread 2
>   --------                         --------
>   gfs2_consist_inode_i()
>     gfs2_dump_glock()
>       gh = first holder
>                                    gfs2_glock_dq_uninit(gh)
>                                      gfs2_glock_dq(gh)
>                                        spin_lock(&gl->gl_lockref.lock)
>                                        list_del_init(&gh->gh_list)
>                                        spin_unlock(&gl->gl_lockref.lock)
>                                      gfs2_holder_uninit(gh)
>                                        put_pid(gh->gh_owner_pid)
>                                        gfs2_holder_mark_uninitialized(gh)
>       dump_holder(gh)
>         pid_is_meaningful(gh)
>         pid_nr(gh->gh_owner_pid)
> 
> Depending on where the stale holder is dereferenced, this can show up as
> a fault in pid_is_meaningful() or as a KASAN report in pid_nr().
> 
> Reuse the existing locked glock dump wrapper for the consistency dumps.
> 
> Reported-by: syzbot+7efd59a5a532c57037e6 at syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7efd59a5a532c57037e6
> Fixes: a739765cd8e6 ("gfs2: dump glocks from gfs2_consist_OBJ_i")
> Cc: stable at vger.kernel.org
> Signed-off-by: Alexey Nepomnyashih <sdl at nppct.ru>

Сейчас добавим в ветки, для доп. тестирования.  Задача будет окончательно
принята позже, когда посмотрим в динамике на падения lvc-фаззинга, которые
достаточно регулярно на эту проблему сыпятся.