fs/mbcache: fix mb_cache_lru_list corruption
With the recent 'commit d07d314e ("fs/mbcache: fix use after free issue in mb_cache_shrink_scan()")', the ce entry is deleted from mbcache list after ce->e_refcnt incremented under global spinlock mb_cache_spinlock. If __mb_cache_entry_release(), is waiting for mb_cache_spinlock at the same time, to add the same ce to mb_cache_lru_list and if it gets the lock after mb_cache_entry_get() deleted it, then it corrupts the list, as that element will be freed immediately after mb_cache_entry_get(). When this list is accessed next time for deleting/adding another ce, we see list corruption issue. Fix this by synchronizing these two contexts with mb_cache_spinlock and evaluating the conditions(ce->e_refcnt) in __mb_cache_entry_release() under the global lock before adding ce to mb_cache_lru_list. Change-Id: I3e20fb4fa163755126e30be7aeca747d74215ed2 Signed-off-by:Sahitya Tummala <stummala@codeaurora.org>
Loading
Please register or sign in to comment