diff options
| author | Jeff Layton <jlayton@kernel.org> | 2022-08-05 13:42:45 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-08-25 12:45:25 +0300 |
| commit | 7a369dc87b66acc85d0cffcf39984344a203e20b (patch) | |
| tree | 7a4f9cbbf3319ee3a8fa72c759eb3632a0935d23 /fs | |
| parent | af412b252550f9ac36d9add7b013c2a2c3463835 (diff) | |
| download | linux-7a369dc87b66acc85d0cffcf39984344a203e20b.tar.xz | |
fscache: don't leak cookie access refs if invalidation is in progress or failed
commit fb24771faf72a2fd62b3b6287af3c610c3ec9cf1 upstream.
It's possible for a request to invalidate a fscache_cookie will come in
while we're already processing an invalidation. If that happens we
currently take an extra access reference that will leak. Only call
__fscache_begin_cookie_access if the FSCACHE_COOKIE_DO_INVALIDATE bit
was previously clear.
Also, ensure that we attempt to clear the bit when the cookie is
"FAILED" and put the reference to avoid an access leak.
Fixes: 85e4ea1049c7 ("fscache: Fix invalidation/lookup race")
Suggested-by: David Howells <dhowells@redhat.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/fscache/cookie.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c index 74920826d8f6..26a6d395737a 100644 --- a/fs/fscache/cookie.c +++ b/fs/fscache/cookie.c @@ -739,6 +739,9 @@ again_locked: fallthrough; case FSCACHE_COOKIE_STATE_FAILED: + if (test_and_clear_bit(FSCACHE_COOKIE_DO_INVALIDATE, &cookie->flags)) + fscache_end_cookie_access(cookie, fscache_access_invalidate_cookie_end); + if (atomic_read(&cookie->n_accesses) != 0) break; if (test_bit(FSCACHE_COOKIE_DO_RELINQUISH, &cookie->flags)) { @@ -1063,8 +1066,8 @@ void __fscache_invalidate(struct fscache_cookie *cookie, return; case FSCACHE_COOKIE_STATE_LOOKING_UP: - __fscache_begin_cookie_access(cookie, fscache_access_invalidate_cookie); - set_bit(FSCACHE_COOKIE_DO_INVALIDATE, &cookie->flags); + if (!test_and_set_bit(FSCACHE_COOKIE_DO_INVALIDATE, &cookie->flags)) + __fscache_begin_cookie_access(cookie, fscache_access_invalidate_cookie); fallthrough; case FSCACHE_COOKIE_STATE_CREATING: spin_unlock(&cookie->lock); |