Compare commits
9 Commits
Author | SHA1 | Date |
---|---|---|
Sergey Cherevko | bf54fd2c22 | 7 months ago |
MSVSphere Packaging Team | b39fc0f6e1 | 7 months ago |
Arkady L. Shane | cc6c705229 | 11 months ago |
Arkady L. Shane | c699980974 | 11 months ago |
Arkady L. Shane | 8bc369acb0 | 1 year ago |
Arkady L. Shane | 40098cb500 | 1 year ago |
MSVSphere Packaging Team | c1a88cfbe9 | 1 year ago |
Alexey Lyubimov | ce8cd0d8ff | 1 year ago |
MSVSphere Packaging Team | b63c172cb4 | 2 years ago |
@ -0,0 +1,47 @@
|
||||
commit a6982d0edd0caeb2a7a0f3465c0adf85a902102a
|
||||
Author: Stephen Brennan stephen.s.brennan@oracle.com
|
||||
Date: Mon Sep 14 16:03:32 2020 -0700
|
||||
|
||||
oracleasm: Access d_bdev before dropping inode
|
||||
|
||||
d_bdev is stored alongside the inode. If we hold the last reference to
|
||||
disk_inode, then iput() will clear the d_bdev field and cause a page
|
||||
fault when it is dereferenced. Further, the iput() could result in a
|
||||
blkdev_put(), after which our accesses to bdev could be further
|
||||
corrupted. To avoid all this, delay the iput() until all access to d,
|
||||
disk_inode, and bdev are complete.
|
||||
|
||||
Ora bug: 31901945
|
||||
Signed-off-by: Stephen Brennan stephen.s.brennan@oracle.com
|
||||
Reviewed-by: Junxiao Bi junxiao.bi@oracle.com
|
||||
Signed-off-by: Somasundaram Krishnasamy somasundaram.krishnasamy@oracle.com
|
||||
|
||||
diff --git a/drivers/block/oracleasm/driver.c b/drivers/block/oracleasm/driver.c
|
||||
index 2bcad19af0d8..02882105f799 100644
|
||||
--- a/drivers/block/oracleasm/driver.c
|
||||
+++ b/drivers/block/oracleasm/driver.c
|
||||
@@ -2380,7 +2380,6 @@ static ssize_t asmfs_svc_query_handle(struct file *file, char *buf, size_t size)
|
||||
}
|
||||
|
||||
d = ASMDISK_I(disk_inode);
|
||||
- iput(disk_inode);
|
||||
bdev = d->d_bdev;
|
||||
|
||||
qh_info->qh_max_sectors = compute_max_sectors(bdev);
|
||||
@@ -2395,6 +2394,15 @@ static ssize_t asmfs_svc_query_handle(struct file *file, char *buf, size_t size)
|
||||
trace_queryhandle(bdev, qh_info);
|
||||
ret = 0;
|
||||
|
||||
+ /*
|
||||
+ * Dropping the reference to disk_inode could result in d and
|
||||
+ * disk_inode being evicted and freed. This will further drop the
|
||||
+ * reference to bdev, which could be the last one. Thus, we must
|
||||
+ * delay the iput() until all accesses to disk_inode, d, and bdev
|
||||
+ * are complete.
|
||||
+ */
|
||||
+ iput(disk_inode);
|
||||
+
|
||||
out:
|
||||
qh_info->qh_abi.ai_status = ret;
|
||||
return size;
|
||||
|
Loading…
Reference in new issue