ocfs2: Fix NULL pointer dereference when tranverse o2hb_all_regions

PATCH New Xue jiufei 2 participants 2 messages Jul 2, 2013 OCFS2

Share & tools

Xue jiufei

author

2013-07-02 08:58 UTC #0 lore raw

PATCH 1/1 ocfs2: Fix NULL pointer dereference when tranverse o2hb_all_regions

There may exist NULL pointer dereference in config_item_name() when one volume(say Volume A) unmounts while another(say Volume B) mounting.

Volume A Volume B
already Mounted.
Unmounting, call
o2hb_heartbeat_group_drop_item()
-> config_item_put(item)
set reg(A)->item.ci_name to NULL
in function config_item_cleanup().
begin mounting, call o2hb_region_pin() and tranverse all regions. When reading reg(A)->item.ci_name, it causes NULL pointer dereference.
call o2hb_region_release() and
del reg(A) from list.

So we should skip accessing regions that is going to release when tranverse o2hb_all_regions.

Signed-off-by Yiwen Jiang <[email protected]>

Signed-off-by joyce <[email protected]>

---
 fs/ocfs2/cluster/heartbeat.c |    9 +++++++++
 1 file changed, 9 insertions(+)

fs/ocfs2/cluster/heartbeat.c +9 -0

index 42252bf..aeafe10 100644
@@ -2389,6 +2389,9 @@ static int o2hb_region_pin(const char *region_uuid)
 	assert_spin_locked(&o2hb_live_lock);
 
 	list_for_each_entry(reg, &o2hb_all_regions, hr_all_item) {
+		if (reg->hr_item_dropped)
+			continue;
+
 		uuid = config_item_name(&reg->hr_item);
 
 		/* local heartbeat */

@@ -2439,6 +2442,9 @@ static void o2hb_region_unpin(const char *region_uuid)
 	assert_spin_locked(&o2hb_live_lock);
 
 	list_for_each_entry(reg, &o2hb_all_regions, hr_all_item) {
+		if (reg->hr_item_dropped)
+			continue;
+
 		uuid = config_item_name(&reg->hr_item);
 		if (region_uuid) {
 			if (strcmp(region_uuid, uuid))

@@ -2654,6 +2660,9 @@ int o2hb_get_all_regions(char *region_uuids, u8 max_regions)
 
 	p = region_uuids;
 	list_for_each_entry(reg, &o2hb_all_regions, hr_all_item) {
+		if (reg->hr_item_dropped)
+			continue;
+
 		mlog(0, "Region: %s\n", config_item_name(&reg->hr_item));
 		if (numregs < max_regions) {
 			memcpy(p, config_item_name(&reg->hr_item),

Signature · 1 line

1.7.9.7

Joel Becker

maintainer

2013-07-02 09:53 UTC #1 lore raw

PATCH 1/1 ocfs2: Fix NULL pointer dereference when tranverse o2hb_all_regions

Quoted 18 lines · Xue jiufei

There may exist NULL pointer dereference in config_item_name() when one volume(say Volume A) unmounts while another(say Volume B) mounting.
Volume A Volume B
already Mounted.
Unmounting, call
o2hb_heartbeat_group_drop_item()
-> config_item_put(item)
set reg(A)->item.ci_name to NULL
in function config_item_cleanup().
begin mounting, call o2hb_region_pin() and tranverse all regions. When reading reg(A)->item.ci_name, it causes NULL pointer dereference.
call o2hb_region_release() and
del reg(A) from list.

Quoted 5 lines

So we should skip accessing regions that is going to release when tranverse o2hb_all_regions.
Signed-off-by Yiwen Jiang <[email protected]>
Signed-off-by joyce <[email protected]>

Good catch.

Acked-by Joel Becker <[email protected]>

Quoted 46 lines

---
 fs/ocfs2/cluster/heartbeat.c |    9 +++++++++
 1 file changed, 9 insertions(+)

fs/ocfs2/cluster/heartbeat.c +9 -0

index 42252bf..aeafe10 100644
@@ -2389,6 +2389,9 @@ static int o2hb_region_pin(const char *region_uuid)
 	assert_spin_locked(&o2hb_live_lock);
 
 	list_for_each_entry(reg, &o2hb_all_regions, hr_all_item) {
+		if (reg->hr_item_dropped)
+			continue;
+
 		uuid = config_item_name(&reg->hr_item);
 
 		/* local heartbeat */

@@ -2439,6 +2442,9 @@ static void o2hb_region_unpin(const char *region_uuid)
 	assert_spin_locked(&o2hb_live_lock);
 
 	list_for_each_entry(reg, &o2hb_all_regions, hr_all_item) {
+		if (reg->hr_item_dropped)
+			continue;
+
 		uuid = config_item_name(&reg->hr_item);
 		if (region_uuid) {
 			if (strcmp(region_uuid, uuid))

@@ -2654,6 +2660,9 @@ int o2hb_get_all_regions(char *region_uuids, u8 max_regions)
 
 	p = region_uuids;
 	list_for_each_entry(reg, &o2hb_all_regions, hr_all_item) {
+		if (reg->hr_item_dropped)
+			continue;
+
 		mlog(0, "Region: %s\n", config_item_name(&reg->hr_item));
 		if (numregs < max_regions) {
 			memcpy(p, config_item_name(&reg->hr_item),

Signature · 7 lines

1.7.9.7


_______________________________________________
Ocfs2-devel mailing list
Ocfs2-devel at oss.oracle.com
https://oss.oracle.com/mailman/listinfo/ocfs2-devel

Signature · 5 lines

"In the long run...we'll all be dead."
                                        -Unknown

			http://www.jlbec.org/
			jlbec at evilplan.org