Re: [PATCH] autofs: serialize allocation of global wait queue tokens

[Ian Kent]

On Wed, 2026-11-11 at 11:40 +0800, Zhu Jun wrote:
> autofs_next_wait_queue is shared by all autofs superblocks, while
> sbi->wq_mutex only serializes requests on one superblock. Concurrent
> requests on different mounts can therefore lose updates to the global
> counter. A delayed update can also move it backwards, allowing an
> outstanding token to be reused on a mount.
> 
> Protect token allocation with a global spinlock. Keep the existing
> token
> type and the wraparound rule that reserves zero.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Zhu Jun <zhujun2@xxxxxxxxxxxxxxxxxxxx>

Yeah, good catch ...

Acked-by: Ian Kent <raven@xxxxxxxxxx>

> ---
>  fs/autofs/waitq.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/autofs/waitq.c b/fs/autofs/waitq.c
> index 92c0bbbf452b..22bc59c2f63e 100644
> --- a/fs/autofs/waitq.c
> +++ b/fs/autofs/waitq.c
> @@ -5,12 +5,14 @@
>   */
>  
>  #include <linux/sched/signal.h>
> +#include <linux/spinlock.h>
>  #include "autofs_i.h"
>  
>  /* We make this a static variable rather than a part of the
> superblock; it
>   * is better if we don't reassign numbers easily even across
> filesystems
>   */
>  static autofs_wqt_t autofs_next_wait_queue = 1;
> +static DEFINE_SPINLOCK(autofs_wait_queue_lock);
>  
>  static void autofs_catatonic_mode_locked(struct autofs_sb_info *sbi)
>  {
> @@ -396,9 +398,11 @@ int autofs_wait(struct autofs_sb_info *sbi,
>  			return -ENOMEM;
>  		}
>  
> +		spin_lock(&autofs_wait_queue_lock);
>  		wq->wait_queue_token = autofs_next_wait_queue;
>  		if (++autofs_next_wait_queue == 0)
>  			autofs_next_wait_queue = 1;
> +		spin_unlock(&autofs_wait_queue_lock);
>  		wq->next = sbi->queues;
>  		sbi->queues = wq;
>  		init_waitqueue_head(&wq->queue);