Hillf Danton a61156314b gfs2: Fix use-after-free in gfs2_glock_shrink_scan ... [ Upstream commit 1ab19c5de4c537ec0d9b21020395a5b5a6c059b2 ] The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to remove the glock from the lru list in __gfs2_glock_put(). On the shrink scan path, the same flag is cleared under lru_lock but because of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the put side can be made without deleting the glock from the lru list. Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to ensure correct behavior on both sides - clear GLF_LRU after list_del under lru_lock. Reported-by: syzbot <syzbot+34ba7ddbf3021981a228@syzkaller.appspotmail.com> Signed-off-by: Hillf Danton <hdanton@sina.com> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-06-18 10:00:04 +02:00
..
acl.c
acl.h
aops.c	gfs2: Fix case in which ail writes are done to jdata holes	2020-11-12 18:55:20 +01:00
aops.h
bmap.c	gfs2: Recursive gfs2_quota_hold in gfs2_iomap_end	2021-03-04 11:38:44 +01:00
bmap.h	gfs2: use iomap for buffered I/O in ordered and writeback mode	2020-10-14 23:54:42 +02:00
dentry.c
dir.c
dir.h
export.c
file.c	gfs2: Prevent direct-I/O write fallback errors from getting lost	2021-06-18 10:00:04 +02:00
gfs2.h
glock.c	gfs2: Fix use-after-free in gfs2_glock_shrink_scan	2021-06-18 10:00:04 +02:00
glock.h
glops.c	gfs2: Don't freeze the file system during unmount	2020-11-25 18:12:08 +01:00
glops.h	gfs2: Split up gfs2_meta_sync into inode and rgrp versions	2020-10-29 22:16:46 +01:00
incore.h	gfs2: set lockdep subclass for iopen glocks	2020-11-24 23:45:58 +01:00
inode.c	gfs2: Fix deadlock between gfs2_{create_inode,inode_lookup} and delete_work_func	2020-12-01 00:21:10 +01:00
inode.h
Kconfig
lock_dlm.c	gfs2: Don't skip dlm unlock if glock has an lvb	2021-03-04 11:38:43 +01:00
log.c	gfs2: fix use-after-free in trans_drain	2021-03-30 14:31:49 +02:00
log.h	gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe	2020-10-15 14:29:03 +02:00
lops.c	gfs2: Split up gfs2_meta_sync into inode and rgrp versions	2020-10-29 22:16:46 +01:00
lops.h	gfs2: Split up gfs2_meta_sync into inode and rgrp versions	2020-10-29 22:16:46 +01:00
main.c
Makefile
meta_io.c	gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe	2020-10-15 14:29:03 +02:00
meta_io.h	gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe	2020-10-15 14:29:03 +02:00
ops_fstype.c	gfs2: move freeze glock outside the make_fs_rw and _ro functions	2021-03-25 09:04:14 +01:00
quota.c
quota.h
recovery.c	gfs2: Add common helper for holding and releasing the freeze glock	2021-03-25 09:04:14 +01:00
recovery.h
rgrp.c	gfs2: check for empty rgrp tree in gfs2_ri_update	2020-11-25 18:10:55 +01:00
rgrp.h	gfs2: Fix NULL pointer dereference in gfs2_rgrp_dump	2020-10-14 23:54:43 +02:00
super.c	gfs2: report "already frozen/thawed" errors	2021-04-16 11:43:20 +02:00
super.h	gfs2: lookup local statfs inodes prior to journal recovery	2020-10-23 15:47:14 +02:00
sys.c	gfs2: use-after-free in sysfs deregistration	2020-10-14 23:54:43 +02:00
sys.h
trace_gfs2.h	gfs2: eliminate GLF_QUEUED flag in favor of list_empty(gl_holders)	2020-10-15 17:04:53 +02:00
trans.c	gfs2: fix use-after-free in trans_drain	2021-03-30 14:31:49 +02:00
trans.h
util.c	gfs2: bypass signal_our_withdraw if no journal	2021-03-25 09:04:14 +01:00
util.h	gfs2: Add common helper for holding and releasing the freeze glock	2021-03-25 09:04:14 +01:00
xattr.c
xattr.h