| From 2ffed5290b3bff7562d29fd06621be4705704242 Mon Sep 17 00:00:00 2001 |
| From: Bob Peterson <rpeterso@redhat.com> |
| Date: Thu, 15 Oct 2020 11:16:48 -0500 |
| Subject: gfs2: Only access gl_delete for iopen glocks |
| |
| From: Bob Peterson <rpeterso@redhat.com> |
| |
| commit 2ffed5290b3bff7562d29fd06621be4705704242 upstream. |
| |
| Only initialize gl_delete for iopen glocks, but more importantly, only access |
| it for iopen glocks in flush_delete_work: flush_delete_work is called for |
| different types of glocks including rgrp glocks, and those use gl_vm which is |
| in a union with gl_delete. Without this fix, we'll end up clobbering gl_vm, |
| which results in general memory corruption. |
| |
| Fixes: a0e3cc65fa29 ("gfs2: Turn gl_delete into a delayed work") |
| Cc: stable@vger.kernel.org # v5.8+ |
| Signed-off-by: Bob Peterson <rpeterso@redhat.com> |
| Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| fs/gfs2/glock.c | 11 +++++++---- |
| 1 file changed, 7 insertions(+), 4 deletions(-) |
| |
| --- a/fs/gfs2/glock.c |
| +++ b/fs/gfs2/glock.c |
| @@ -1054,7 +1054,8 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, |
| gl->gl_object = NULL; |
| gl->gl_hold_time = GL_GLOCK_DFT_HOLD; |
| INIT_DELAYED_WORK(&gl->gl_work, glock_work_func); |
| - INIT_DELAYED_WORK(&gl->gl_delete, delete_work_func); |
| + if (gl->gl_name.ln_type == LM_TYPE_IOPEN) |
| + INIT_DELAYED_WORK(&gl->gl_delete, delete_work_func); |
| |
| mapping = gfs2_glock2aspace(gl); |
| if (mapping) { |
| @@ -1906,9 +1907,11 @@ bool gfs2_delete_work_queued(const struc |
| |
| static void flush_delete_work(struct gfs2_glock *gl) |
| { |
| - if (cancel_delayed_work(&gl->gl_delete)) { |
| - queue_delayed_work(gfs2_delete_workqueue, |
| - &gl->gl_delete, 0); |
| + if (gl->gl_name.ln_type == LM_TYPE_IOPEN) { |
| + if (cancel_delayed_work(&gl->gl_delete)) { |
| + queue_delayed_work(gfs2_delete_workqueue, |
| + &gl->gl_delete, 0); |
| + } |
| } |
| gfs2_glock_queue_work(gl, 0); |
| } |