From patchwork Tue Mar 31 08:59:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228595 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0D4CC2D0E8 for ; Tue, 31 Mar 2020 09:19:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id ADFB320675 for ; Tue, 31 Mar 2020 09:19:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585646383; bh=mJQ0BF9iUHKFsG4Vqthf273UpMIufUGa1gqjsyWZtUU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=kVb3rzfobVG1uH8iovbJsLoIZ0hsno60pVajHWjbEjJptZZD/r+WcprRgrIyiGhnh BAhqL3inVCUgzXHK6hzMgtwgrWsSPtBMeN/rEGiOEWaChIpZDYnCEkNvJECDs3EgaX 6c5bLNBylsfHSicaHnEnhD3l0X2l4ksqDGwuUKFI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731934AbgCaJRF (ORCPT ); Tue, 31 Mar 2020 05:17:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:38096 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731070AbgCaJRF (ORCPT ); Tue, 31 Mar 2020 05:17:05 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0F5AC2072E; Tue, 31 Mar 2020 09:17:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585646224; bh=mJQ0BF9iUHKFsG4Vqthf273UpMIufUGa1gqjsyWZtUU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KBUk9ToLa7rtKLGVmvEfVmGCWJ2vEZAu2gLdfwQIAGl1frGZ4qqFKGch6bICZVKY+ yfhhWj8eKMa3f92JxILOW+oZzHiEl0XVOyI2OOZ92XCLcmvM1aEjRDAffZhdcZy1/6 ir3MBxMzccWgsUcL6qTpfeLJLV/adEFNHc6rOmlg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Howells , Marc Dionne , Linus Torvalds Subject: [PATCH 5.4 121/155] afs: Fix unpinned address list during probing Date: Tue, 31 Mar 2020 10:59:21 +0200 Message-Id: <20200331085431.974258624@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200331085418.274292403@linuxfoundation.org> References: <20200331085418.274292403@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: David Howells commit 9efcc4a129363187c9bf15338692f107c5c9b6f0 upstream. When it's probing all of a fileserver's interfaces to find which one is best to use, afs_do_probe_fileserver() takes a lock on the server record and notes the pointer to the address list. It doesn't, however, pin the address list, so as soon as it drops the lock, there's nothing to stop the address list from being freed under us. Fix this by taking a ref on the address list inside the locked section and dropping it at the end of the function. Fixes: 3bf0fb6f33dd ("afs: Probe multiple fileservers simultaneously") Signed-off-by: David Howells Reviewed-by: Marc Dionne Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/afs/fs_probe.c | 2 ++ 1 file changed, 2 insertions(+) --- a/fs/afs/fs_probe.c +++ b/fs/afs/fs_probe.c @@ -145,6 +145,7 @@ static int afs_do_probe_fileserver(struc read_lock(&server->fs_lock); ac.alist = rcu_dereference_protected(server->addresses, lockdep_is_held(&server->fs_lock)); + afs_get_addrlist(ac.alist); read_unlock(&server->fs_lock); atomic_set(&server->probe_outstanding, ac.alist->nr_addrs); @@ -163,6 +164,7 @@ static int afs_do_probe_fileserver(struc if (!in_progress) afs_fs_probe_done(server); + afs_put_addrlist(ac.alist); return in_progress; }