Commit 275655d3 authored by Al Viro's avatar Al Viro
Browse files

afs: fix __afs_break_callback() / afs_drop_open_mmap() race 



In __afs_break_callback() we might check ->cb_nr_mmap and if it's non-zero
do queue_work(&vnode->cb_work).  In afs_drop_open_mmap() we decrement
->cb_nr_mmap and do flush_work(&vnode->cb_work) if it reaches zero.

The trouble is, there's nothing to prevent __afs_break_callback() from
seeing ->cb_nr_mmap before the decrement and do queue_work() after both
the decrement and flush_work().  If that happens, we might be in trouble -
vnode might get freed before the queued work runs.

__afs_break_callback() is always done under ->cb_lock, so let's make
sure that ->cb_nr_mmap can change from non-zero to zero while holding
->cb_lock (the spinlock component of it - it's a seqlock and we don't
need to mess with the counter).

Acked-by: default avatarChristian Brauner <brauner@kernel.org>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent af072cf6

fs/afs/file.c

+6 −2
Original line number Diff line number Diff line
@@ -417,13 +417,17 @@ static void afs_add_open_mmap(struct afs_vnode *vnode) 


static void afs_drop_open_mmap(struct afs_vnode *vnode)

{

	if (!atomic_dec_and_test(&vnode->cb_nr_mmap))

	if (atomic_add_unless(&vnode->cb_nr_mmap, -1, 1))

		return;



	down_write(&vnode->volume->open_mmaps_lock);



	if (atomic_read(&vnode->cb_nr_mmap) == 0)

	read_seqlock_excl(&vnode->cb_lock);

	// the only place where ->cb_nr_mmap may hit 0

	// see __afs_break_callback() for the other side...

	if (atomic_dec_and_test(&vnode->cb_nr_mmap))

		list_del_init(&vnode->cb_mmap_link);

	read_sequnlock_excl(&vnode->cb_lock);



	up_write(&vnode->volume->open_mmaps_lock);

	flush_work(&vnode->cb_work);