fs/mbcache: fix use after free issue in mb_cache_shrink_scan()
Fix the below potential race between these two contexts -
mb_cache_entry_get() and mb_cache_shrink_scan(), which results
into use after free issue.
task a:
mb_cache_shrink_scan()
|--if(!list_empty(&mb_cache_lru_list))
|--get the ce entry
|--list_del_init(&ce->e_lru_list);
|--check ce->e_used, ce->e_queued,
ce->e_refcnt and continue
-> gets prempted here
task b:
ext4_xattr_release_block()
|--mb_cache_entry_get()
|--get ce from hlist_bl_for_each_entry()
|--increment ce->e_used and
list_del_init(&ce->e_lru_list)
|--mb_cache_entry_free()
|--hlist_bl_lock(ce->e_block_hash_p);
-> results into use after free
Also, fix similar potential race between mb_cache_entry_alloc() and
mb_cache_entry_get() in case if cache->c_max_entries is reached.
Change-Id: I01049bae5d914cfb8494ab299ec2e068745d1110
Signed-off-by:
Sahitya Tummala <stummala@codeaurora.org>
Loading
Please register or sign in to comment