lkml.org 
[lkml]   [2019]   [Apr]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 032/187] ocfs2: fix a panic problem caused by o2cb_ctl
    Date
    4.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit cc725ef3cb202ef2019a3c67c8913efa05c3cce6 ]

    In the process of creating a node, it will cause NULL pointer
    dereference in kernel if o2cb_ctl failed in the interval (mkdir,
    o2cb_set_node_attribute(node_num)] in function o2cb_add_node.

    The node num is initialized to 0 in function o2nm_node_group_make_item,
    o2nm_node_group_drop_item will mistake the node number 0 for a valid
    node number when we delete the node before the node number is set
    correctly. If the local node number of the current host happens to be
    0, cluster->cl_local_node will be set to O2NM_INVALID_NODE_NUM while
    o2hb_thread still running. The panic stack is generated as follows:

    o2hb_thread
    \-o2hb_do_disk_heartbeat
    \-o2hb_check_own_slot
    |-slot = &reg->hr_slots[o2nm_this_node()];
    //o2nm_this_node() return O2NM_INVALID_NODE_NUM

    We need to check whether the node number is set when we delete the node.

    Link: http://lkml.kernel.org/r/133d8045-72cc-863e-8eae-5013f9f6bc51@huawei.com
    Signed-off-by: Jia Guo <guojia12@huawei.com>
    Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
    Acked-by: Jun Piao <piaojun@huawei.com>
    Cc: Mark Fasheh <mark@fasheh.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Junxiao Bi <junxiao.bi@oracle.com>
    Cc: Changwei Ge <ge.changwei@h3c.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/ocfs2/cluster/nodemanager.c | 14 ++++++++------
    1 file changed, 8 insertions(+), 6 deletions(-)

    diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
    index 0e4166cc23a0..4ac775e32240 100644
    --- a/fs/ocfs2/cluster/nodemanager.c
    +++ b/fs/ocfs2/cluster/nodemanager.c
    @@ -621,13 +621,15 @@ static void o2nm_node_group_drop_item(struct config_group *group,
    struct o2nm_node *node = to_o2nm_node(item);
    struct o2nm_cluster *cluster = to_o2nm_cluster(group->cg_item.ci_parent);

    - o2net_disconnect_node(node);
    + if (cluster->cl_nodes[node->nd_num] == node) {
    + o2net_disconnect_node(node);

    - if (cluster->cl_has_local &&
    - (cluster->cl_local_node == node->nd_num)) {
    - cluster->cl_has_local = 0;
    - cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
    - o2net_stop_listening(node);
    + if (cluster->cl_has_local &&
    + (cluster->cl_local_node == node->nd_num)) {
    + cluster->cl_has_local = 0;
    + cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
    + o2net_stop_listening(node);
    + }
    }

    /* XXX call into net to stop this node from trading messages */
    --
    2.19.1


    \
     
     \ /
      Last update: 2019-04-04 11:44    [W:2.973 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site