Re: [patch V2 6/7] fs/jbd2: Make state lock a spinlock

[Jan Kara]

On Thu 01-08-19 20:12:11, Thomas Gleixner wrote:
> On Thu, 1 Aug 2019, Jan Kara wrote:
> > On Thu 01-08-19 03:01:32, Thomas Gleixner wrote:
> > > As almost all functions which use this lock have a journal head pointer
> > > readily available, it makes more sense to remove the lock helper inlines
> > > and write out spin_*lock() at all call sites.
> > > 
> > 
> > Just a heads up that I didn't miss this patch. Just it has some bugs and I
> > figured that rather than explaining to you subtleties of jh lifetime it is
> > easier to fix up the problems myself since you're probably not keen on
> > becoming jbd2 developer ;)... which was more complex than I thought so I'm
> > not completely done yet. Hopefuly tomorrow.
> 
> I'm curious where I was too naive :)

Well, the most obvious where places where the result ended up being like

	jbd2_journal_put_journal_head(jh);
	spin_unlock(&jh->state_lock);

That's possible use-after-free.

But there were also other more subtle places where
jbd2_journal_put_journal_head() was not directly visible as it was hidden
inside journal list handling functions such as __jbd2_journal_refile_buffer()
or so. And these needed some more work.

Anyway, I'm now done fixing up the patch, doing some xfstests runs to verify
things didn't break in any obvious way...

								Honza
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR