Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0b3a2c99 authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Steven Whitehouse
Browse files

GFS2: Fix unsafe dereference in dump_holder() 



GLOCK_BUG_ON() might call this function without RCU read lock. Make sure that
RCU read lock is held when using task_struct returned from pid_task().

Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarSteven Whitehouse <swhiteho@redhat.com>
parent 582d2f7a

fs/gfs2/glock.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -1655,6 +1655,7 @@ static int dump_holder(struct seq_file *seq, const struct gfs2_holder *gh) 
	struct task_struct *gh_owner = NULL;

	struct task_struct *gh_owner = NULL;

	char flags_buf[32];

	char flags_buf[32];





	rcu_read_lock();

	if (gh->gh_owner_pid)

	if (gh->gh_owner_pid)

		gh_owner = pid_task(gh->gh_owner_pid, PIDTYPE_PID);

		gh_owner = pid_task(gh->gh_owner_pid, PIDTYPE_PID);

	gfs2_print_dbg(seq, " H: s:%s f:%s e:%d p:%ld [%s] %pS\n",

	gfs2_print_dbg(seq, " H: s:%s f:%s e:%d p:%ld [%s] %pS\n",
@@ -1664,6 +1665,7 @@ static int dump_holder(struct seq_file *seq, const struct gfs2_holder *gh) 
		       gh->gh_owner_pid ? (long)pid_nr(gh->gh_owner_pid) : -1,

		       gh->gh_owner_pid ? (long)pid_nr(gh->gh_owner_pid) : -1,

		       gh_owner ? gh_owner->comm : "(ended)",

		       gh_owner ? gh_owner->comm : "(ended)",

		       (void *)gh->gh_ip);

		       (void *)gh->gh_ip);

	rcu_read_unlock();

	return 0;

	return 0;

}

}