Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Rock Li <lihongweizz@inspur.com>
To:     <mark@fasheh.com>, <jlbec@evilplan.org>,
        <joseph.qi@linux.alibaba.com>
CC:     <ocfs2-devel@oss.oracle.com>, <linux-kernel@vger.kernel.org>,
        Rock Li <lihongweizz@inspur.com>
Subject: [PATCH] ocfs2: fix crash issue if access released lockres in debugfs
Date:   Tue, 20 Sep 2022 15:36:38 +0800
Message-ID: <20220920073638.1358-1-lihongweizz@inspur.com>
MIME-Version: 1.0
Content-Type: text/plain
tUid:   2022920153711997fac9f361039e13e098431dd3977e6
Abuse-Reports-To: service@corp-email.com
Precedence: bulk

Access locking_state of dlm debugfs may cause crash as scene below:

Proc A:                  Proc that access debuginfo:
add_lockres_tracking(lockresA)
...
                         ocfs2_dlm_seq_next():
                           //priv->p_iter_res points to next
                           //lockres e.g. B. priv->p_tmp_res hold
                           //copy of lockres A before leave
                         ocfs2_dlm_seq_show()
...
remove_lockres_tracking(lockres B):
  //free lockres B, l_debug_list in
  //priv->p_ter_res is updated but not
  //priv->p_tmp_res
...
                         ocfs2_dlm_seq_next():
			   //priv->p_tmp_res which holds a old copy of
                           //lockres A, the l_debug_list holds a
                           //out-of-date succeed pointer, which will
                           //cause crash as //access invalid memory
                           iter = v; //priv->p_tmp_res
                           iter = ocfs2_dlm_next_res(iter, priv)

The root cause of this issue is that private->p_iter_res acts as the
agent of accessing lockres and is protected by ocfs2_dlm_tracking_lock
while p_tmp_res is only a copy of the lockres and will be out-of-dated
after leave critial region of ocfs2_dlm_tracking_lock. We should use
priv->p_ter_res as the forward iterater instead.

Signed-off-by: Rock Li <lihongweizz@inspur.com>
---
 fs/ocfs2/dlmglue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index c28bc98..5d84350 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -3109,7 +3109,7 @@ static void *ocfs2_dlm_seq_next(struct seq_file *m, void *v, loff_t *pos)
 	struct ocfs2_lock_res *dummy = &priv->p_iter_res;
 
 	spin_lock(&ocfs2_dlm_tracking_lock);
-	iter = ocfs2_dlm_next_res(iter, priv);
+	iter = ocfs2_dlm_next_res(dummy, priv);
 	list_del_init(&dummy->l_debug_list);
 	if (iter) {
 		list_add(&dummy->l_debug_list, &iter->l_debug_list);
-- 
1.8.3.1