|
| 1 | +gfs2: fix double destroy_workqueue error |
| 2 | + |
| 3 | +jira LE-3201 |
| 4 | +Rebuild_History Non-Buildable kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 |
| 5 | +commit-author Julian Sun < [email protected]> |
| 6 | +commit 6cb9df81a2c462b89d2f9611009ab43ae8717841 |
| 7 | +Empty-Commit: Cherry-Pick Conflicts during history rebuild. |
| 8 | +Will be included in final tarball splat. Ref for failed cherry-pick at: |
| 9 | +ciq/ciq_backports/kernel-rt-4.18.0-553.32.1.rt7.373.el8_10/6cb9df81.failed |
| 10 | + |
| 11 | +When gfs2_fill_super() fails, destroy_workqueue() is called within |
| 12 | +gfs2_gl_hash_clear(), and the subsequent code path calls |
| 13 | +destroy_workqueue() on the same work queue again. |
| 14 | + |
| 15 | +This issue can be fixed by setting the work queue pointer to NULL after |
| 16 | +the first destroy_workqueue() call and checking for a NULL pointer |
| 17 | +before attempting to destroy the work queue again. |
| 18 | + |
| 19 | + |
| 20 | +Closes: https://syzkaller.appspot.com/bug?extid=d34c2a269ed512c531b0 |
| 21 | +Fixes: 30e388d57367 ("gfs2: Switch to a per-filesystem glock workqueue") |
| 22 | + |
| 23 | + Signed-off-by: Julian Sun < [email protected]> |
| 24 | + Signed-off-by: Andreas Gruenbacher < [email protected]> |
| 25 | +(cherry picked from commit 6cb9df81a2c462b89d2f9611009ab43ae8717841) |
| 26 | + Signed-off-by: Jonathan Maple < [email protected]> |
| 27 | + |
| 28 | +# Conflicts: |
| 29 | +# fs/gfs2/glock.c |
| 30 | +# fs/gfs2/ops_fstype.c |
| 31 | +diff --cc fs/gfs2/glock.c |
| 32 | +index 755846f2501f,269c3bc7fced..000000000000 |
| 33 | +--- a/fs/gfs2/glock.c |
| 34 | ++++ b/fs/gfs2/glock.c |
| 35 | +@@@ -2172,6 -2250,8 +2172,11 @@@ void gfs2_gl_hash_clear(struct gfs2_sb |
| 36 | + gfs2_lm_unmount(sdp); |
| 37 | + gfs2_free_dead_glocks(sdp); |
| 38 | + glock_hash_walk(dump_glock_func, sdp); |
| 39 | +++<<<<<<< HEAD |
| 40 | +++======= |
| 41 | ++ destroy_workqueue(sdp->sd_glock_wq); |
| 42 | ++ sdp->sd_glock_wq = NULL; |
| 43 | +++>>>>>>> 6cb9df81a2c4 (gfs2: fix double destroy_workqueue error) |
| 44 | + } |
| 45 | + |
| 46 | + static const char *state2str(unsigned state) |
| 47 | +diff --cc fs/gfs2/ops_fstype.c |
| 48 | +index 65032e10b64a,e83d293c3614..000000000000 |
| 49 | +--- a/fs/gfs2/ops_fstype.c |
| 50 | ++++ b/fs/gfs2/ops_fstype.c |
| 51 | +@@@ -1287,6 -1306,9 +1287,12 @@@ fail_debug |
| 52 | + gfs2_sys_fs_del(sdp); |
| 53 | + fail_delete_wq: |
| 54 | + destroy_workqueue(sdp->sd_delete_wq); |
| 55 | +++<<<<<<< HEAD |
| 56 | +++======= |
| 57 | ++ fail_glock_wq: |
| 58 | ++ if (sdp->sd_glock_wq) |
| 59 | ++ destroy_workqueue(sdp->sd_glock_wq); |
| 60 | +++>>>>>>> 6cb9df81a2c4 (gfs2: fix double destroy_workqueue error) |
| 61 | + fail_free: |
| 62 | + free_sbd(sdp); |
| 63 | + sb->s_fs_info = NULL; |
| 64 | +* Unmerged path fs/gfs2/glock.c |
| 65 | +* Unmerged path fs/gfs2/ops_fstype.c |
0 commit comments