Dmitry Monakhov 213116e53f jbd2: fix race between jbd2_journal_remove_checkpoint and ->j_commit_callback ... commit 794446c694 upstream. The following race is possible: [kjournald2] other_task jbd2_journal_commit_transaction() j_state = T_FINISHED; spin_unlock(&journal->j_list_lock); ->jbd2_journal_remove_checkpoint() ->jbd2_journal_free_transaction(); ->kmem_cache_free(transaction) ->j_commit_callback(journal, transaction); -> USE_AFTER_FREE WARNING: at lib/list_debug.c:62 __list_del_entry+0x1c0/0x250() Hardware name: list_del corruption. prev->next should be ffff88019a4ec198, but was 6b6b6b6b6b6b6b6b Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf coretemp kvm_intel kvm crc32c_intel ghash_clmulni_intel microcode sg xhci_hcd button sd_mod crc_t10dif aesni_intel ablk_helper cryptd lrw aes_x86_64 xts gf128mul ahci libahci pata_acpi ata_generic dm_mirror dm_region_hash dm_log dm_mod Pid: 16400, comm: jbd2/dm-1-8 Tainted: G W 3.8.0-rc3+ #107 Call Trace: [<ffffffff8106fb0d>] warn_slowpath_common+0xad/0xf0 [<ffffffff8106fc06>] warn_slowpath_fmt+0x46/0x50 [<ffffffff813637e9>] ? ext4_journal_commit_callback+0x99/0xc0 [<ffffffff8148cae0>] __list_del_entry+0x1c0/0x250 [<ffffffff813637bf>] ext4_journal_commit_callback+0x6f/0xc0 [<ffffffff813ca336>] jbd2_journal_commit_transaction+0x23a6/0x2570 [<ffffffff8108aa42>] ? try_to_del_timer_sync+0x82/0xa0 [<ffffffff8108b491>] ? del_timer_sync+0x91/0x1e0 [<ffffffff813d3ecf>] kjournald2+0x19f/0x6a0 [<ffffffff810ad630>] ? wake_up_bit+0x40/0x40 [<ffffffff813d3d30>] ? bit_spin_lock+0x80/0x80 [<ffffffff810ac6be>] kthread+0x10e/0x120 [<ffffffff810ac5b0>] ? __init_kthread_worker+0x70/0x70 [<ffffffff818ff6ac>] ret_from_fork+0x7c/0xb0 [<ffffffff810ac5b0>] ? __init_kthread_worker+0x70/0x70 In order to demonstrace this issue one should mount ext4 with mount -o discard option on SSD disk. This makes callback longer and race window becomes wider. In order to fix this we should mark transaction as finished only after callbacks have completed Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2013-05-07 19:51:57 -07:00
..
acpi	Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux	2012-05-05 10:06:06 -07:00
asm-generic	mm: allow arch code to control the user page table ceiling	2013-05-07 19:51:55 -07:00
crypto	crypto: user - Fix lookup of algorithms with IV generator	2012-03-29 19:52:47 +08:00
drm	drm/radeon: add Richland pci ids	2013-03-28 12:12:13 -07:00
keys
linux	jbd2: fix race between jbd2_journal_remove_checkpoint and ->j_commit_callback	2013-05-07 19:51:57 -07:00
math-emu
media	Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media	2012-05-14 11:23:37 -07:00
misc
mtd
net	net: fix incorrect credentials passing	2013-05-01 09:41:16 -07:00
pcmcia
rdma	infiniband: pass rdma_cm module to netlink_dump_start	2012-10-28 10:14:15 -07:00
rxrpc
scsi	SCSI: libsas: fix taskfile corruption in sas_ata_qc_fill_rtf	2012-07-16 09:04:37 -07:00
sound	ALSA: Add a reference counter to card instance	2012-11-17 13:16:13 -08:00
target	target: Add link_magic for fabric allow_link destination target_items	2013-01-21 11:45:24 -08:00
trace	xen/mmu: Use Xen specific TLB flush instead of the generic one.	2012-11-17 13:15:54 -08:00
video	atmel_lcdfb: fix 16-bpp modes on older SOCs	2013-03-20 13:05:00 -07:00
xen	xen/blkback: correctly respond to unknown, non-native requests	2013-04-05 10:04:18 -07:00
Kbuild