mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-30 16:07:39 +00:00
Code Issues Releases Wiki Activity
linux-stable/fs/xfs
History
Dave Chinner c7f87f3984 xfs: fix use-after-free on CIL context on shutdown 
xlog_wait() on the CIL context can reference a freed context if the
waiter doesn't get scheduled before the CIL context is freed. This
can happen when a task is on the hard throttle and the CIL push
aborts due to a shutdown. This was detected by generic/019:

thread 1			thread 2

__xfs_trans_commit
 xfs_log_commit_cil
  <CIL size over hard throttle limit>
  xlog_wait
   schedule
				xlog_cil_push_work
				wake_up_all
				<shutdown aborts commit>
				xlog_cil_committed
				kmem_free

   remove_wait_queue
    spin_lock_irqsave --> UAF

Fix it by moving the wait queue to the CIL rather than keeping it in
in the CIL context that gets freed on push completion. Because the
wait queue is now independent of the CIL context and we might have
multiple contexts in flight at once, only wake the waiters on the
push throttle when the context we are pushing is over the hard
throttle size threshold.

Fixes: 0e7ab7efe7 ("xfs: Throttle commits on delayed background CIL push")
Reported-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
2020-06-22 19:22:57 -07:00
..
libxfs xfs: more lockdep whackamole with kmem_alloc* 2020-05-27 08:49:28 -07:00
scrub xfs: move the fork format fields into struct xfs_ifork 2020-05-19 09:40:58 -07:00
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
kmem.c mm: remove the pgprot argument to __vmalloc 2020-06-02 10:59:11 -07:00
kmem.h xfs: more lockdep whackamole with kmem_alloc* 2020-05-27 08:49:28 -07:00
Makefile xfs: refactor log recovery item sorting into a generic dispatch structure 2020-05-08 08:49:58 -07:00
mrlock.h
xfs.h
xfs_acl.c xfs: only allocate the buffer size actually needed in __xfs_set_acl 2020-03-02 20:55:55 -08:00
xfs_acl.h xfs: improve xfs_forget_acl 2020-03-02 20:55:55 -08:00
xfs_aops.c New code for 5.8: 2020-06-02 19:21:40 -07:00
xfs_aops.h xfs: add a xfs_inode_buftarg helper 2019-10-28 08:37:54 -07:00
xfs_attr_inactive.c xfs: cleanup xfs_idestroy_fork 2020-05-19 09:40:59 -07:00
xfs_attr_list.c xfs: move the fork format fields into struct xfs_ifork 2020-05-19 09:40:58 -07:00
xfs_bio_io.c xfs: chain bios the right way around in xfs_rw_bdev 2019-07-10 10:04:16 -07:00
xfs_bmap_item.c xfs: hoist setting of XFS_LI_RECOVERED to caller 2020-05-08 08:50:01 -07:00
xfs_bmap_item.h xfs: refactor intent item RECOVERED flag into the log item 2020-05-08 08:50:01 -07:00
xfs_bmap_util.c xfs: move the fork format fields into struct xfs_ifork 2020-05-19 09:40:58 -07:00
xfs_bmap_util.h xfs: simplify xfs_iomap_eof_align_last_fsb 2019-11-03 10:22:30 -08:00
xfs_buf.c New code for 5.8: 2020-06-02 19:21:40 -07:00
xfs_buf.h xfs: refactor ratelimited buffer error messages into helper 2020-05-07 08:27:46 -07:00
xfs_buf_item.c xfs: combine xfs_trans_ail_[remove|delete]() 2020-05-07 08:27:48 -07:00
xfs_buf_item.h xfs: refactor failed buffer resubmission into xfsaild 2020-05-07 08:27:45 -07:00
xfs_buf_item_recover.c xfs: move log recovery buffer cancellation code to xfs_buf_item_recover.c 2020-05-08 08:50:01 -07:00
xfs_dir2_readdir.c xfs: move the fork format fields into struct xfs_ifork 2020-05-19 09:40:58 -07:00
xfs_discard.c xfs: remove XFS_BUF_TO_AGF 2020-03-11 09:11:39 -07:00
xfs_discard.h
xfs_dquot.c xfs: per-type quota timers and warn limits 2020-05-27 08:49:26 -07:00
xfs_dquot.h xfs: pass xfs_dquot to xfs_qm_adjust_dqtimers 2020-05-27 08:49:26 -07:00
xfs_dquot_item.c xfs: combine xfs_trans_ail_[remove|delete]() 2020-05-07 08:27:48 -07:00
xfs_dquot_item.h xfs: factor out quotaoff intent AIL removal and memory free 2020-03-18 08:12:23 -07:00
xfs_dquot_item_recover.c xfs: remove log recovery quotaoff item dispatch for pass2 commit functions 2020-05-08 08:49:59 -07:00
xfs_error.c xfs: random buffer write failure errortag 2020-05-07 08:27:48 -07:00
xfs_error.h xfs: xfs_buf_corruption_error should take __this_address 2020-03-12 07:58:12 -07:00
xfs_export.c xfs: factor out a new xfs_log_force_inode helper 2020-04-06 08:44:35 -07:00
xfs_export.h
xfs_extent_busy.c xfs: cleanup use of the XFS_ALLOC_ flags 2019-11-03 10:22:31 -08:00
xfs_extent_busy.h
xfs_extfree_item.c xfs: hoist setting of XFS_LI_RECOVERED to caller 2020-05-08 08:50:01 -07:00
xfs_extfree_item.h xfs: refactor intent item RECOVERED flag into the log item 2020-05-08 08:50:01 -07:00
xfs_file.c mmap locking API: convert mmap_sem comments 2020-06-09 09:39:14 -07:00
xfs_filestream.c xfs: make xfs_*read_agf return EAGAIN to ALLOC_FLAG_TRYLOCK callers 2020-01-26 14:32:26 -08:00
xfs_filestream.h
xfs_fsmap.c xfs: prohibit fs freezing when using empty transactions 2020-03-26 08:19:24 -07:00
xfs_fsmap.h
xfs_fsops.c xfs: remove unused shutdown types 2020-05-07 08:27:48 -07:00
xfs_fsops.h xfs: change some error-less functions to void types 2019-05-01 20:26:30 -07:00
xfs_globals.c xfs: multithreaded iwalk implementation 2019-07-03 07:33:26 -07:00
xfs_health.c xfs: introduce new v5 bulkstat structure 2019-07-03 20:36:26 -07:00
xfs_icache.c (More) new code for 5.8: 2020-06-02 19:48:41 -07:00
xfs_icache.h xfs: straighten out all the naming around incore inode tree walks 2020-05-27 08:49:27 -07:00
xfs_icreate_item.c xfs: refactor log recovery icreate item dispatch for pass2 commit functions 2020-05-08 08:49:59 -07:00
xfs_icreate_item.h
xfs_inode.c Fixes for 5.8: 2020-06-13 12:40:24 -07:00
xfs_inode.h (More) new code for 5.8: 2020-06-02 19:48:41 -07:00
xfs_inode_item.c xfs: move the fork format fields into struct xfs_ifork 2020-05-19 09:40:58 -07:00
xfs_inode_item.h xfs: remove unused iflush stale parameter 2020-05-07 08:27:48 -07:00
xfs_inode_item_recover.c xfs: improve local fork verification 2020-05-19 09:40:58 -07:00
xfs_ioctl.c Third part of new DAX code for 5.8: 2020-06-11 10:48:12 -07:00
xfs_ioctl.h xfs: embedded the attrlist cursor into struct xfs_attr_list_context 2020-03-02 20:55:55 -08:00
xfs_ioctl32.c xfs: lift cursor copy in/out into xfs_ioc_attr_list 2020-03-02 20:55:54 -08:00
xfs_ioctl32.h xfs: rename compat_time_t to old_time32_t 2020-01-06 08:57:36 -08:00
xfs_iomap.c xfs: refactor xfs_iomap_prealloc_size 2020-05-27 08:49:28 -07:00
xfs_iomap.h xfs: simplify the xfs_iomap_write_direct calling 2019-11-03 10:22:30 -08:00
xfs_iops.c mmap locking API: convert mmap_sem comments 2020-06-09 09:39:14 -07:00
xfs_iops.h
xfs_itable.c xfs: move the fork format fields into struct xfs_ifork 2020-05-19 09:40:58 -07:00
xfs_itable.h xfs: remove all *_ITER_ABORT values 2019-08-29 21:22:41 -07:00
xfs_iwalk.c xfs: kill the XFS_WANT_CORRUPT_* macros 2019-11-12 17:19:02 -08:00
xfs_iwalk.h xfs: remove all *_ITER_CONTINUE values 2019-08-30 22:43:56 -07:00
xfs_linux.h xfs: clean up the attr flag confusion 2020-03-02 20:55:55 -08:00
xfs_log.c xfs: don't write a corrupt unmount record to force summary counter recalc 2020-03-27 08:32:55 -07:00
xfs_log.h xfs: refactor and split xfs_log_done() 2020-03-27 08:32:53 -07:00
xfs_log_cil.c xfs: fix use-after-free on CIL context on shutdown 2020-06-22 19:22:57 -07:00
xfs_log_priv.h xfs: fix use-after-free on CIL context on shutdown 2020-06-22 19:22:57 -07:00
xfs_log_recover.c xfs: remove unnecessary includes from xfs_log_recover.c 2020-05-08 08:50:01 -07:00
xfs_message.c xfs: refactor ratelimited buffer error messages into helper 2020-05-07 08:27:46 -07:00
xfs_message.h xfs: refactor ratelimited buffer error messages into helper 2020-05-07 08:27:46 -07:00
xfs_mount.c xfs: reduce free inode accounting overhead 2020-05-27 08:49:25 -07:00
xfs_mount.h fs/xfs: Make DAX mount option a tri-state 2020-05-29 20:13:20 -07:00
xfs_mru_cache.c fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. 2019-08-26 12:06:22 -07:00
xfs_mru_cache.h
xfs_ondisk.h xfs: make struct xfs_buf_log_format have a consistent size 2020-01-16 08:07:23 -08:00
xfs_pnfs.c xfs: define printk_once variants for xfs messages 2020-05-04 09:03:15 -07:00
xfs_pnfs.h
xfs_pwork.c xfs: poll waiting for quotacheck 2019-07-03 08:21:58 -07:00
xfs_pwork.h xfs: poll waiting for quotacheck 2019-07-03 08:21:58 -07:00
xfs_qm.c xfs: per-type quota timers and warn limits 2020-05-27 08:49:26 -07:00
xfs_qm.h xfs: per-type quota timers and warn limits 2020-05-27 08:49:26 -07:00
xfs_qm_bhv.c xfs: remove the xfs_disk_dquot_t and xfs_dquot_t 2019-11-13 11:13:45 -08:00
xfs_qm_syscalls.c xfs: straighten out all the naming around incore inode tree walks 2020-05-27 08:49:27 -07:00
xfs_quota.h xfs: remove the icdinode di_uid/di_gid members 2020-03-02 20:55:50 -08:00
xfs_quotaops.c xfs: per-type quota timers and warn limits 2020-05-27 08:49:26 -07:00
xfs_refcount_item.c xfs: hoist setting of XFS_LI_RECOVERED to caller 2020-05-08 08:50:01 -07:00
xfs_refcount_item.h xfs: refactor intent item RECOVERED flag into the log item 2020-05-08 08:50:01 -07:00
xfs_reflink.c xfs: fix partially uninitialized structure in xfs_reflink_remap_extent 2020-04-13 08:00:23 -07:00
xfs_reflink.h xfs: change return value of xfs_inode_need_cow to int 2020-01-20 14:34:47 -08:00
xfs_rmap_item.c xfs: hoist setting of XFS_LI_RECOVERED to caller 2020-05-08 08:50:01 -07:00
xfs_rmap_item.h xfs: refactor intent item RECOVERED flag into the log item 2020-05-08 08:50:01 -07:00
xfs_rtalloc.c xfs: make xfs_trans_get_buf return an error code 2020-01-26 14:32:26 -08:00
xfs_rtalloc.h
xfs_stats.c xfs: Use scnprintf() for avoiding potential buffer overflow 2020-03-12 07:58:13 -07:00
xfs_stats.h
xfs_super.c (More) new code for 5.8: 2020-06-02 19:48:41 -07:00
xfs_super.h xfs: include QUOTA, FATAL ASSERT build options in XFS_BUILD_OPTIONS 2019-10-21 09:04:57 -07:00
xfs_symlink.c xfs: move the fork format fields into struct xfs_ifork 2020-05-19 09:40:58 -07:00
xfs_symlink.h xfs: Correct comment tyops -> typos 2019-11-10 10:21:57 -08:00
xfs_sysctl.c sysctl: pass kernel pointers to ->proc_handler 2020-04-27 02:07:40 -04:00
xfs_sysctl.h xfs: multithreaded iwalk implementation 2019-07-03 07:33:26 -07:00
xfs_sysfs.c xfs: avoid unused to_mp() function warning 2019-09-24 09:40:19 -07:00
xfs_sysfs.h
xfs_trace.c xfs: support bulk loading of staged btrees 2020-03-18 08:12:23 -07:00
xfs_trace.h xfs: move the fork format fields into struct xfs_ifork 2020-05-19 09:40:58 -07:00
xfs_trans.c xfs: remove the m_active_trans counter 2020-05-27 08:49:25 -07:00
xfs_trans.h xfs: refactor intent item RECOVERED flag into the log item 2020-05-08 08:50:01 -07:00
xfs_trans_ail.c xfs: refactor adding recovered intent items to the log 2020-05-08 08:50:00 -07:00
xfs_trans_buf.c xfs: fix xfs_buf_ioerror_alert location reporting 2020-01-26 14:32:27 -08:00
xfs_trans_dquot.c xfs: per-type quota timers and warn limits 2020-05-27 08:49:26 -07:00
xfs_trans_priv.h xfs: refactor adding recovered intent items to the log 2020-05-08 08:50:00 -07:00
xfs_xattr.c xfs: remove duplicate headers 2020-05-08 08:51:34 -07:00