locking, fs/locks: Add missing file_sem locks

I overlooked a few code-paths that can lead to
locks_delete_global_locks().

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Jeff Layton <jlayton@poochiereds.net>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Bruce Fields <bfields@fieldses.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-fsdevel@vger.kernel.org
Cc: syzkaller <syzkaller@googlegroups.com>
Link: http://lkml.kernel.org/r/20161008081228.GF3142@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>

1 files changed, 6 insertions, 0 deletions

diff --git a/fs/locks.c b/fs/locks.c
index ce93b416b490..22c5b4aa4961 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1609,6 +1609,7 @@ int fcntl_getlease(struct file *filp)
 
         ctx = smp_load_acquire(&inode->i_flctx);
         if (ctx && !list_empty_careful(&ctx->flc_lease)) {
+                percpu_down_read_preempt_disable(&file_rwsem);
                 spin_lock(&ctx->flc_lock);
                 time_out_leases(inode, &dispose);
                 list_for_each_entry(fl, &ctx->flc_lease, fl_list) {
@@ -1618,6 +1619,8 @@ int fcntl_getlease(struct file *filp)
                         break;
                 }
                 spin_unlock(&ctx->flc_lock);
+                percpu_up_read_preempt_enable(&file_rwsem);
+
                 locks_dispose_list(&dispose);
         }
         return type;
@@ -2529,11 +2532,14 @@ locks_remove_lease(struct file *filp, struct file_lock_context *ctx)
         if (list_empty(&ctx->flc_lease))
                 return;
 
+        percpu_down_read_preempt_disable(&file_rwsem);
         spin_lock(&ctx->flc_lock);
         list_for_each_entry_safe(fl, tmp, &ctx->flc_lease, fl_list)
                 if (filp == fl->fl_file)
                         lease_modify(fl, F_UNLCK, &dispose);
         spin_unlock(&ctx->flc_lock);
+        percpu_up_read_preempt_enable(&file_rwsem);
+
         locks_dispose_list(&dispose);
 }