linux-kernel - [PATCH] [5.10-LTS NFS] fix assert failure in __fscache_disable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250626020035.1043638-1-zhangjian496@huawei.com>
Date: Thu, 26 Jun 2025 10:00:35 +0800
From: zhangjian <zhangjian496@...wei.com>
To: <gregkh@...uxfoundation.org>, <darrick.wong@...cle.com>,
	<dhowells@...hat.com>
CC: <linux-kernel@...r.kernel.org>, <linux-nfs@...r.kernel.org>,
	<stable@...r.kernel.org>
Subject: [PATCH] [5.10-LTS NFS] fix assert failure in __fscache_disable_cookie

Multi write opens will go into __fscache_disable_cookie and cookie->n_active
may be zero for a short window. Move this assertion under locking to avoid
assert failure for ASSERTCMP(atomic_read(&cookie->n_active), >, 0).

stack is as following:

 fscache_disable_cookie include/linux/fscache.h:854 [inline]
 nfs_fscache_open_file+0x3ba/0x430 fs/nfs/fscache.c:319
 nfs4_file_open+0x4ff/0x780 fs/nfs/nfs4file.c:90
 do_dentry_open+0x6ea/0x1170 fs/open.c:826
 do_open.isra.0+0x9dc/0xf50 fs/namei.c:3316
 path_openat+0x336/0x810 fs/namei.c:3434
 do_filp_open+0x1b9/0x290 fs/namei.c:3461
 do_sys_openat2+0x5be/0x9b0 fs/open.c:1231
 do_sys_open+0xc8/0x150 fs/open.c:1248
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x67/0xd1

Signed-off-by: zhangjian <zhangjian496@...wei.com>
---
 fs/fscache/cookie.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 6104f627c..30f0e2b41 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -703,6 +703,9 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie,
 
 	_enter("%p,%u", cookie, invalidate);
 
+	wait_on_bit_lock(&cookie->flags, FSCACHE_COOKIE_ENABLEMENT_LOCK,
+			 TASK_UNINTERRUPTIBLE);
+
 	trace_fscache_disable(cookie);
 
 	ASSERTCMP(atomic_read(&cookie->n_active), >, 0);
@@ -713,9 +716,6 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie,
 		BUG();
 	}
 
-	wait_on_bit_lock(&cookie->flags, FSCACHE_COOKIE_ENABLEMENT_LOCK,
-			 TASK_UNINTERRUPTIBLE);
-
 	fscache_update_aux(cookie, aux_data);
 
 	if (!test_and_clear_bit(FSCACHE_COOKIE_ENABLED, &cookie->flags))
-- 
2.33.0