[PATCH v2] fs: jfs: fix possible data races in txExit()

From: Jia-Ju Bai
Date: Tue May 05 2020 - 11:07:23 EST


The functions txEnd() and txExit() can be concurrently executed in the
following call contexts:

Thread1:
jfs_lazycommit()
txLazyCommit()
txEnd()
Thread2:
exit_jfs_fs()
txExit()

In txEnd():
struct tblock *tblk = tid_to_tblock(tid);
// #define tid_to_tblock(tid) (&TxBlock[tid])

In txExit():
vfree(TxBlock);
TxBlock = NULL;

Data races can occur for the global variable TxBlock, and they
can cause use-after-free bugs and null-pointer dereferences.
These data races were found by our concurrency fuzzer.

Thus call txExit() after the filesystem stops the threads
that run jfs_lazycommit().

Signed-off-by: Jia-Ju Bai <baijiaju1990@xxxxxxxxx>
---
v2:
* Change the description.
Thank Markus Elfring for good advice.

fs/jfs/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index b2dc4d1f9dcc..8c80397df336 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -1027,13 +1027,13 @@ static void __exit exit_jfs_fs(void)

jfs_info("exit_jfs_fs called");

- txExit();
metapage_exit();

kthread_stop(jfsIOthread);
for (i = 0; i < commit_threads; i++)
kthread_stop(jfsCommitThread[i]);
kthread_stop(jfsSyncThread);
+ txExit();
#ifdef PROC_FS_JFS
jfs_proc_clean();
#endif
--
2.17.1