From patchwork Sat Jan 11 01:19:13 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Srinivas Eeda X-Patchwork-Id: 3468691 Return-Path: X-Original-To: patchwork-ocfs2-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 89B9E9F169 for ; Sat, 11 Jan 2014 01:20:27 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id C07862013A for ; Sat, 11 Jan 2014 01:20:26 +0000 (UTC) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id C62A5200F2 for ; Sat, 11 Jan 2014 01:20:25 +0000 (UTC) Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by aserp1040.oracle.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.1) with ESMTP id s0B1JnH7021648 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sat, 11 Jan 2014 01:19:50 GMT Received: from oss.oracle.com (oss-external.oracle.com [137.254.96.51]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s0B1Jj7N019243 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 11 Jan 2014 01:19:45 GMT Received: from localhost ([127.0.0.1] helo=oss.oracle.com) by oss.oracle.com with esmtp (Exim 4.63) (envelope-from ) id 1W1nEn-0006vX-GO; Fri, 10 Jan 2014 17:19:45 -0800 Received: from acsinet21.oracle.com ([141.146.126.237]) by oss.oracle.com with esmtp (Exim 4.63) (envelope-from ) id 1W1nEH-0006ts-UM for ocfs2-devel@oss.oracle.com; Fri, 10 Jan 2014 17:19:14 -0800 Received: from ca-server1.us.oracle.com (ca-server1.us.oracle.com [139.185.48.5]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s0B1JDe4018808 for ; Sat, 11 Jan 2014 01:19:13 GMT Received: from seeda by ca-server1.us.oracle.com with local (Exim 4.69) (envelope-from ) id 1W1nEH-00018E-Da for ocfs2-devel@oss.oracle.com; Fri, 10 Jan 2014 17:19:13 -0800 From: Srinivas Eeda To: ocfs2-devel@oss.oracle.com Date: Fri, 10 Jan 2014 17:19:13 -0800 Message-Id: <1389403153-4220-1-git-send-email-srinivas.eeda@oracle.com> X-Mailer: git-send-email 1.7.5.1 Subject: [Ocfs2-devel] [PATCH 1/1] o2dlm: fix NULL pointer dereference in o2dlm_blocking_ast_wrapper X-BeenThere: ocfs2-devel@oss.oracle.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ocfs2-devel-bounces@oss.oracle.com Errors-To: ocfs2-devel-bounces@oss.oracle.com X-Source-IP: acsinet21.oracle.com [141.146.126.237] X-Spam-Status: No, score=-4.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Srinivas Eeda A tiny race between BAST and unlock message causes the NULL dereference. A node sends an unlock request to master and receives a response. Before processing the response it receives a BAST from the master. Since both requests are processed by different threads it creates a race. While the BAST is being processed, lock can get freed by unlock code. This patch makes bast to return immediately if lock is found but unlock is pending. The code should handle this race. We also have to fix master node to skip sending BAST after receiving unlock message. Below is the crash stack BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 IP: [] o2dlm_blocking_ast_wrapper+0xd/0x16 [] dlm_do_local_bast+0x8e/0x97 [ocfs2_dlm] [] dlm_proxy_ast_handler+0x838/0x87e [ocfs2_dlm] [] o2net_process_message+0x395/0x5b8 [ocfs2_nodemanager] [] o2net_rx_until_empty+0x762/0x90d [ocfs2_nodemanager] [] worker_thread+0x14d/0x1ed Signed-off-by: Srinivas Eeda --- fs/ocfs2/dlm/dlmast.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/ocfs2/dlm/dlmast.c b/fs/ocfs2/dlm/dlmast.c index b46278f..dbc6cee 100644 --- a/fs/ocfs2/dlm/dlmast.c +++ b/fs/ocfs2/dlm/dlmast.c @@ -385,8 +385,13 @@ int dlm_proxy_ast_handler(struct o2net_msg *msg, u32 len, void *data, head = &res->granted; list_for_each_entry(lock, head, list) { - if (lock->ml.cookie == cookie) - goto do_ast; + /* if lock is found but unlock is pending ignore the bast */ + if (lock->ml.cookie == cookie) { + if (lock->unlock_pending) + break; + else + goto do_ast; + } } mlog(0, "Got %sast for unknown lock! cookie=%u:%llu, name=%.*s, "