locks: Fix potential OOPS in generic_setlease()
authorPavel Emelyanov <xemul@openvz.org>
Thu, 20 Sep 2007 08:45:02 +0000 (12:45 +0400)
committerJ. Bruce Fields <bfields@citi.umich.edu>
Tue, 9 Oct 2007 22:32:45 +0000 (18:32 -0400)
commit85c59580b30c82aa771aa33b37217a6b6851bc14
tree02e96b437a63908ad3791021d352ad2aefff9936
parentf0c1cd0eaf0b127356c2c09e40305453bc361b0f
locks: Fix potential OOPS in generic_setlease()

This code is run under lock_kernel(), which is dropped during
sleeping operations, so the following race is possible:

CPU1:                                CPU2:
  vfs_setlease();                    vfs_setlease();
  lock_kernel();
                                     lock_kernel(); /* spin */
  generic_setlease():
    ...
    for (before = ...)
    /* here we found some lease after
     * which we will insert the new one
     */
    fl = locks_alloc_lock();
    /* go to sleep in this allocation and
     * drop the BKL
     */
                                     generic_setlease():
                                       ...
                                       for (before = ...)
                                       /* here we find the "before" pointing
                                        * at the one we found on CPU1
                                        */
                                      ->fl_change(my_before, arg);
                                              lease_modify();
                                                     locks_free_lock();
                                                     /* and we freed it */
                                     ...
                                     unlock_kernel();
   locks_insert_lock(before, fl);
   /* OOPS! We have just tried to add the lease
    * at the tail of already removed one
    */

The similar races are already handled in other code - all the
allocations are performed before any checks/updates.

Thanks to Kamalesh Babulal for testing and for a bug report on an
earlier version.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Cc: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
fs/locks.c