Commit 0c7d7d1f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'xfs-5.8-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fix from Darrick Wong:
 "Fix a use-after-free bug when the fs shuts down"

* tag 'xfs-5.8-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: fix use-after-free on CIL context on shutdown
parents 7fec3ce5 c7f87f39
Loading
Loading
Loading
Loading
+5 −5
Original line number Diff line number Diff line
@@ -671,7 +671,8 @@ xlog_cil_push_work(
	/*
	 * Wake up any background push waiters now this context is being pushed.
	 */
	wake_up_all(&ctx->push_wait);
	if (ctx->space_used >= XLOG_CIL_BLOCKING_SPACE_LIMIT(log))
		wake_up_all(&cil->xc_push_wait);

	/*
	 * Check if we've anything to push. If there is nothing, then we don't
@@ -743,13 +744,12 @@ xlog_cil_push_work(

	/*
	 * initialise the new context and attach it to the CIL. Then attach
	 * the current context to the CIL committing lsit so it can be found
	 * the current context to the CIL committing list so it can be found
	 * during log forces to extract the commit lsn of the sequence that
	 * needs to be forced.
	 */
	INIT_LIST_HEAD(&new_ctx->committing);
	INIT_LIST_HEAD(&new_ctx->busy_extents);
	init_waitqueue_head(&new_ctx->push_wait);
	new_ctx->sequence = ctx->sequence + 1;
	new_ctx->cil = cil;
	cil->xc_ctx = new_ctx;
@@ -937,7 +937,7 @@ xlog_cil_push_background(
	if (cil->xc_ctx->space_used >= XLOG_CIL_BLOCKING_SPACE_LIMIT(log)) {
		trace_xfs_log_cil_wait(log, cil->xc_ctx->ticket);
		ASSERT(cil->xc_ctx->space_used < log->l_logsize);
		xlog_wait(&cil->xc_ctx->push_wait, &cil->xc_push_lock);
		xlog_wait(&cil->xc_push_wait, &cil->xc_push_lock);
		return;
	}

@@ -1216,12 +1216,12 @@ xlog_cil_init(
	INIT_LIST_HEAD(&cil->xc_committing);
	spin_lock_init(&cil->xc_cil_lock);
	spin_lock_init(&cil->xc_push_lock);
	init_waitqueue_head(&cil->xc_push_wait);
	init_rwsem(&cil->xc_ctx_lock);
	init_waitqueue_head(&cil->xc_commit_wait);

	INIT_LIST_HEAD(&ctx->committing);
	INIT_LIST_HEAD(&ctx->busy_extents);
	init_waitqueue_head(&ctx->push_wait);
	ctx->sequence = 1;
	ctx->cil = cil;
	cil->xc_ctx = ctx;
+1 −1
Original line number Diff line number Diff line
@@ -240,7 +240,6 @@ struct xfs_cil_ctx {
	struct xfs_log_vec	*lv_chain;	/* logvecs being pushed */
	struct list_head	iclog_entry;
	struct list_head	committing;	/* ctx committing list */
	wait_queue_head_t	push_wait;	/* background push throttle */
	struct work_struct	discard_endio_work;
};

@@ -274,6 +273,7 @@ struct xfs_cil {
	wait_queue_head_t	xc_commit_wait;
	xfs_lsn_t		xc_current_sequence;
	struct work_struct	xc_push_work;
	wait_queue_head_t	xc_push_wait;	/* background push throttle */
} ____cacheline_aligned_in_smp;

/*