Commit 2ffed529 authored by Bob Peterson's avatar Bob Peterson Committed by Andreas Gruenbacher
Browse files

gfs2: Only access gl_delete for iopen glocks 



Only initialize gl_delete for iopen glocks, but more importantly, only access
it for iopen glocks in flush_delete_work: flush_delete_work is called for
different types of glocks including rgrp glocks, and those use gl_vm which is
in a union with gl_delete.  Without this fix, we'll end up clobbering gl_vm,
which results in general memory corruption.

Fixes: a0e3cc65 ("gfs2: Turn gl_delete into a delayed work")
Cc: stable@vger.kernel.org # v5.8+
Signed-off-by: default avatarBob Peterson <rpeterso@redhat.com>
Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
parent dbffb29d

fs/gfs2/glock.c

+7 −4
Original line number Diff line number Diff line
@@ -1051,6 +1051,7 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number, 
	gl->gl_object = NULL;

	gl->gl_hold_time = GL_GLOCK_DFT_HOLD;

	INIT_DELAYED_WORK(&gl->gl_work, glock_work_func);

	if (gl->gl_name.ln_type == LM_TYPE_IOPEN)

		INIT_DELAYED_WORK(&gl->gl_delete, delete_work_func);



	mapping = gfs2_glock2aspace(gl);
@@ -1900,10 +1901,12 @@ bool gfs2_delete_work_queued(const struct gfs2_glock *gl) 


static void flush_delete_work(struct gfs2_glock *gl)

{

	if (gl->gl_name.ln_type == LM_TYPE_IOPEN) {

		if (cancel_delayed_work(&gl->gl_delete)) {

			queue_delayed_work(gfs2_delete_workqueue,

					   &gl->gl_delete, 0);

		}

	}

	gfs2_glock_queue_work(gl, 0);

}