Forwarded: Re: [syzbot] general protection fault in lmLogSync (2)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: Re: [syzbot] general protection fault in lmLogSync (2)
Author: koike@xxxxxxxxxx

#syz test

diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c                     
                                                                            
                                                                            
                                                       
index 5b1c5da04163..1fa202fc0458 100644                                     
                                                                            
                                                                            
                                                       
--- a/fs/jfs/jfs_logmgr.c                                                   
                                                                            
                                                                            
                                                       
+++ b/fs/jfs/jfs_logmgr.c                                                   
                                                                            
                                                                            
                                                       
@@ -74,12 +74,6 @@ static struct lbuf *log_redrive_list;                   
                                                                            
                                                                            
                                                       
 static DEFINE_SPINLOCK(log_redrive_lock);                                 
                                                                            
                                                                            
                                                       
                                                                            
                                                                            
                                                                            
                                                       
                                                                            
                                                                            
                                                                            
                                                       
-/*                                                                         
                                                                            
                                                                            
                                                       
- *     log read/write serialization (per log)                             
                                                                            
                                                                            
                                                       
- */                                                                       
                                                                            
                                                                            
                                                       
-#define LOG_LOCK_INIT(log)     mutex_init(&(log)->loglock)                 
                                                                            
                                                                            
                                                       
-#define LOG_LOCK(log)          mutex_lock(&((log)->loglock))               
                                                                            
                                                                            
                                                       
-#define LOG_UNLOCK(log)                mutex_unlock(&((log)->loglock))     
                                                                            
                                                                            
                                                       
                                                                            
                                                                            
                                                                            
                                                       
                                                                            
                                                                            
                                                                            
                                                       
 /*                                                                         
                                                                            
                                                                            
                                                       
diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h                     
                                                                            
                                                                            
                                                       
index 8b8994e48cd0..09e0ef6aecce 100644                                     
                                                                            
                                                                            
                                                       
--- a/fs/jfs/jfs_logmgr.h                                                   
                                                                            
                                                                            
                                                       
+++ b/fs/jfs/jfs_logmgr.h
@@ -402,6 +402,13 @@ struct jfs_log {
        int no_integrity;       /* 3: flag to disable journaling to disk */
 };
 
+/*
+ * log read/write serialization (per log)
+ */
+#define LOG_LOCK_INIT(log)     mutex_init(&(log)->loglock)
+#define LOG_LOCK(log)          mutex_lock(&((log)->loglock))
+#define LOG_UNLOCK(log)                mutex_unlock(&((log)->loglock))
+
 /*
  * Log flag
  */
diff --git a/fs/jfs/jfs_umount.c b/fs/jfs/jfs_umount.c
index 8ec43f53f686..8547bb5cd3f4 100644
--- a/fs/jfs/jfs_umount.c
+++ b/fs/jfs/jfs_umount.c
@@ -20,6 +20,7 @@
 #include "jfs_superblock.h"
 #include "jfs_dmap.h"
 #include "jfs_imap.h"
+#include "jfs_logmgr.h"
 #include "jfs_metapage.h"
 #include "jfs_debug.h"
 
@@ -63,6 +64,12 @@ int jfs_umount(struct super_block *sb)
        diUnmount(ipimap, 0);
 
        diFreeSpecial(ipimap);
+       /*
+        * Hold log lock so write_special_inodes (lmLogSync) cannot see
+        * this sbi with a NULL inode pointer while iterating log->sb_list.
+        */
+       if (log)
+               LOG_LOCK(log);
        sbi->ipimap = NULL;
 
        /*
@@ -88,6 +95,8 @@ int jfs_umount(struct super_block *sb)
 
        diFreeSpecial(ipbmap);
        sbi->ipbmap = NULL;
+       if (log)
+               LOG_UNLOCK(log);
         /*
         * Make sure all metadata makes it to disk before we mark

-- 
You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@xxxxxxxxxxxxxxxx.
To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/079704e1-9af1-42a7-85a3-6b48be909525n%40googlegroups.com.