* [PATCH v2] gfs2: fix double destroy_workqueue error
@ 2024-08-20 15:08 Julian Sun
2024-08-21 17:41 ` Andreas Gruenbacher
0 siblings, 1 reply; 2+ messages in thread
From: Julian Sun @ 2024-08-20 15:08 UTC (permalink / raw)
To: gfs2, syzbot+d34c2a269ed512c531b0; +Cc: agruenba, Julian Sun, stable
When gfs2_fill_super() fails, destroy_workqueue()
is called within gfs2_gl_hash_clear(), and the
subsequent code path calls destroy_workqueue()
on the same work queue again.
This issue can be fixed by setting the work
queue pointer to NULL after the first
destroy_workqueue() call and checking for
a NULL pointer before attempting to destroy
the work queue again.
Reported-by: syzbot+d34c2a269ed512c531b0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d34c2a269ed512c531b0
Fixes: 30e388d57367 ("gfs2: Switch to a per-filesystem glock workqueue")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Sun <sunjunchao2870@gmail.com>
---
fs/gfs2/glock.c | 1 +
fs/gfs2/ops_fstype.c | 3 ++-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 32991cb22023..5838039d78e3 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -2273,6 +2273,7 @@ void gfs2_gl_hash_clear(struct gfs2_sbd *sdp)
gfs2_free_dead_glocks(sdp);
glock_hash_walk(dump_glock_func, sdp);
destroy_workqueue(sdp->sd_glock_wq);
+ sdp->sd_glock_wq = NULL;
}
static const char *state2str(unsigned state)
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 0561edd6cc86..5c0e1b24d6ec 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1308,7 +1308,8 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
fail_delete_wq:
destroy_workqueue(sdp->sd_delete_wq);
fail_glock_wq:
- destroy_workqueue(sdp->sd_glock_wq);
+ if (sdp->sd_glock_wq)
+ destroy_workqueue(sdp->sd_glock_wq);
fail_free:
free_sbd(sdp);
sb->s_fs_info = NULL;
--
2.39.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] gfs2: fix double destroy_workqueue error
2024-08-20 15:08 [PATCH v2] gfs2: fix double destroy_workqueue error Julian Sun
@ 2024-08-21 17:41 ` Andreas Gruenbacher
0 siblings, 0 replies; 2+ messages in thread
From: Andreas Gruenbacher @ 2024-08-21 17:41 UTC (permalink / raw)
To: Julian Sun; +Cc: gfs2, syzbot+d34c2a269ed512c531b0, stable
On Tue, Aug 20, 2024 at 5:09 PM Julian Sun <sunjunchao2870@gmail.com> wrote:
> When gfs2_fill_super() fails, destroy_workqueue()
> is called within gfs2_gl_hash_clear(), and the
> subsequent code path calls destroy_workqueue()
> on the same work queue again.
>
> This issue can be fixed by setting the work
> queue pointer to NULL after the first
> destroy_workqueue() call and checking for
> a NULL pointer before attempting to destroy
> the work queue again.
Applied now.
Thanks,
Andreas
> Reported-by: syzbot+d34c2a269ed512c531b0@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d34c2a269ed512c531b0
> Fixes: 30e388d57367 ("gfs2: Switch to a per-filesystem glock workqueue")
> Cc: stable@vger.kernel.org
> Signed-off-by: Julian Sun <sunjunchao2870@gmail.com>
> ---
> fs/gfs2/glock.c | 1 +
> fs/gfs2/ops_fstype.c | 3 ++-
> 2 files changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
> index 32991cb22023..5838039d78e3 100644
> --- a/fs/gfs2/glock.c
> +++ b/fs/gfs2/glock.c
> @@ -2273,6 +2273,7 @@ void gfs2_gl_hash_clear(struct gfs2_sbd *sdp)
> gfs2_free_dead_glocks(sdp);
> glock_hash_walk(dump_glock_func, sdp);
> destroy_workqueue(sdp->sd_glock_wq);
> + sdp->sd_glock_wq = NULL;
> }
>
> static const char *state2str(unsigned state)
> diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
> index 0561edd6cc86..5c0e1b24d6ec 100644
> --- a/fs/gfs2/ops_fstype.c
> +++ b/fs/gfs2/ops_fstype.c
> @@ -1308,7 +1308,8 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
> fail_delete_wq:
> destroy_workqueue(sdp->sd_delete_wq);
> fail_glock_wq:
> - destroy_workqueue(sdp->sd_glock_wq);
> + if (sdp->sd_glock_wq)
> + destroy_workqueue(sdp->sd_glock_wq);
> fail_free:
> free_sbd(sdp);
> sb->s_fs_info = NULL;
> --
> 2.39.2
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-08-21 17:41 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-20 15:08 [PATCH v2] gfs2: fix double destroy_workqueue error Julian Sun
2024-08-21 17:41 ` Andreas Gruenbacher
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).