MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-06 17:35:20 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

ocfs2: cancel dqi_sync_work before freeing oinfo

Browse Source 
commit 35fccce29f upstream.

ocfs2_global_read_info() will initialize and schedule dqi_sync_work at the
end, if error occurs after successfully reading global quota, it will
trigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled:

ODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c

This reports that there is an active delayed work when freeing oinfo in
error handling, so cancel dqi_sync_work first.  BTW, return status instead
of -1 when .read_file_info fails.

Link: https://syzkaller.appspot.com/bug?extid=f7af59df5d6b25f0febd
Link: https://lkml.kernel.org/r/20240904071004.2067695-1-joseph.qi@linux.alibaba.com
Fixes: 171bf93ce1 ("ocfs2: Periodic quota syncing")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Reported-by: syzbot+f7af59df5d6b25f0febd@syzkaller.appspotmail.com
Tested-by: syzbot+f7af59df5d6b25f0febd@syzkaller.appspotmail.com
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Joseph Qi 2024-09-04 15:10:03 +08:00 committed by Greg Kroah-Hartman
parent 637c00e065
commit ef76802036
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fs/ocfs2/quota_local.c
View File

@ -689,7 +689,7 @@ static int ocfs2_local_read_info(struct super_block *sb, int type)
int status; int status;
struct buffer_head *bh = NULL; struct buffer_head *bh = NULL;
struct ocfs2_quota_recovery *rec; struct ocfs2_quota_recovery *rec;
int locked = 0; int locked = 0, global_read = 0;
info->dqi_max_spc_limit = 0x7fffffffffffffffLL; info->dqi_max_spc_limit = 0x7fffffffffffffffLL;
info->dqi_max_ino_limit = 0x7fffffffffffffffLL; info->dqi_max_ino_limit = 0x7fffffffffffffffLL;
@ -697,6 +697,7 @@ static int ocfs2_local_read_info(struct super_block *sb, int type)
if (!oinfo) { if (!oinfo) {
mlog(ML_ERROR, "failed to allocate memory for ocfs2 quota" mlog(ML_ERROR, "failed to allocate memory for ocfs2 quota"
" info."); " info.");
status = -ENOMEM;
goto out_err; goto out_err;
} }
info->dqi_priv = oinfo; info->dqi_priv = oinfo;
@ -709,6 +710,7 @@ static int ocfs2_local_read_info(struct super_block *sb, int type)
status = ocfs2_global_read_info(sb, type); status = ocfs2_global_read_info(sb, type);
if (status < 0) if (status < 0)
goto out_err; goto out_err;
global_read = 1;
status = ocfs2_inode_lock(lqinode, &oinfo->dqi_lqi_bh, 1); status = ocfs2_inode_lock(lqinode, &oinfo->dqi_lqi_bh, 1);
if (status < 0) { if (status < 0) {
@ -779,10 +781,12 @@ out_err:
if (locked) if (locked)
ocfs2_inode_unlock(lqinode, 1); ocfs2_inode_unlock(lqinode, 1);
ocfs2_release_local_quota_bitmaps(&oinfo->dqi_chunk); ocfs2_release_local_quota_bitmaps(&oinfo->dqi_chunk);
if (global_read)
cancel_delayed_work_sync(&oinfo->dqi_sync_work);
kfree(oinfo); kfree(oinfo);
} }
brelse(bh); brelse(bh);
return -1; return status;
} }
/* Write local info to quota file */ /* Write local info to quota file */