48 lines
1.7 KiB
Diff
48 lines
1.7 KiB
Diff
|
commit a6982d0edd0caeb2a7a0f3465c0adf85a902102a
|
||
|
|
Author: Stephen Brennan stephen.s.brennan@oracle.com
|
||
|
|
Date: Mon Sep 14 16:03:32 2020 -0700
|
||
|
|
|
||
|
|
oracleasm: Access d_bdev before dropping inode
|
||
|
|
|
||
|
|
d_bdev is stored alongside the inode. If we hold the last reference to
|
||
|
|
disk_inode, then iput() will clear the d_bdev field and cause a page
|
||
|
|
fault when it is dereferenced. Further, the iput() could result in a
|
||
|
|
blkdev_put(), after which our accesses to bdev could be further
|
||
|
|
corrupted. To avoid all this, delay the iput() until all access to d,
|
||
|
|
disk_inode, and bdev are complete.
|
||
|
|
|
||
|
|
Ora bug: 31901945
|
||
|
|
Signed-off-by: Stephen Brennan stephen.s.brennan@oracle.com
|
||
|
|
Reviewed-by: Junxiao Bi junxiao.bi@oracle.com
|
||
|
|
Signed-off-by: Somasundaram Krishnasamy somasundaram.krishnasamy@oracle.com
|
||
|
|
|
||
|
|
diff --git a/drivers/block/oracleasm/driver.c b/drivers/block/oracleasm/driver.c
|
||
|
|
index 2bcad19af0d8..02882105f799 100644
|
||
|
|
--- a/drivers/block/oracleasm/driver.c
|
||
|
|
+++ b/drivers/block/oracleasm/driver.c
|
||
|
|
@@ -2380,7 +2380,6 @@ static ssize_t asmfs_svc_query_handle(struct file *file, char *buf, size_t size)
|
||
|
|
}
|
||
|
|
|
||
|
|
d = ASMDISK_I(disk_inode);
|
||
|
|
- iput(disk_inode);
|
||
|
|
bdev = d->d_bdev;
|
||
|
|
|
||
|
|
qh_info->qh_max_sectors = compute_max_sectors(bdev);
|
||
|
|
@@ -2395,6 +2394,15 @@ static ssize_t asmfs_svc_query_handle(struct file *file, char *buf, size_t size)
|
||
|
|
trace_queryhandle(bdev, qh_info);
|
||
|
|
ret = 0;
|
||
|
|
|
||
|
|
+ /*
|
||
|
|
+ * Dropping the reference to disk_inode could result in d and
|
||
|
|
+ * disk_inode being evicted and freed. This will further drop the
|
||
|
|
+ * reference to bdev, which could be the last one. Thus, we must
|
||
|
|
+ * delay the iput() until all accesses to disk_inode, d, and bdev
|
||
|
|
+ * are complete.
|
||
|
|
+ */
|
||
|
|
+ iput(disk_inode);
|
||
|
|
+
|
||
|
|
out:
|
||
|
|
qh_info->qh_abi.ai_status = ret;
|
||
|
|
return size;
|
||
|
|
|