ocfs2: Concurrent access of o2hb_region->hr_task was not locked

This means that a build-up and a teardown could race which would result in a
double-kthread_stop().

Protect the setting and clearing of hr_task with o2hb_live_lock, as it's not
a common thing and not performance critical.

Signed-off-by: Joel Becker <joel.becker@oracle.com>
Signed-off-by: Mark Fasheh <mark.fasheh@oracle.com>

1 files changed, 32 insertions, 12 deletions

diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 0f2cfecd42c0..eba282da500e 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1234,6 +1234,7 @@ static ssize_t o2hb_region_dev_write(struct o2hb_region *reg,
                                      const char *page,
                                      size_t count)
 {
+        struct task_struct *hb_task;
         long fd;
         int sectsize;
         char *p = (char *)page;
@@ -1319,20 +1320,28 @@ static ssize_t o2hb_region_dev_write(struct o2hb_region *reg,
          */
         atomic_set(&reg->hr_steady_iterations, O2HB_LIVE_THRESHOLD + 1);
 
-        reg->hr_task = kthread_run(o2hb_thread, reg, "o2hb-%s",
-                                   reg->hr_item.ci_name);
-        if (IS_ERR(reg->hr_task)) {
-                ret = PTR_ERR(reg->hr_task);
+        hb_task = kthread_run(o2hb_thread, reg, "o2hb-%s",
+                              reg->hr_item.ci_name);
+        if (IS_ERR(hb_task)) {
+                ret = PTR_ERR(hb_task);
                 mlog_errno(ret);
-                reg->hr_task = NULL;
                 goto out;
         }
 
+        spin_lock(&o2hb_live_lock);
+        reg->hr_task = hb_task;
+        spin_unlock(&o2hb_live_lock);
+
         ret = wait_event_interruptible(o2hb_steady_queue,
                                 atomic_read(&reg->hr_steady_iterations) == 0);
         if (ret) {
-                kthread_stop(reg->hr_task);
+                spin_lock(&o2hb_live_lock);
+                hb_task = reg->hr_task;
                 reg->hr_task = NULL;
+                spin_unlock(&o2hb_live_lock);
+
+                if (hb_task)
+                        kthread_stop(hb_task);
                 goto out;
         }
 
@@ -1354,10 +1363,17 @@ out:
 static ssize_t o2hb_region_pid_read(struct o2hb_region *reg,
                                       char *page)
 {
-        if (!reg->hr_task)
+        pid_t pid = 0;
+
+        spin_lock(&o2hb_live_lock);
+        if (reg->hr_task)
+                pid = reg->hr_task->pid;
+        spin_unlock(&o2hb_live_lock);
+
+        if (!pid)
                 return 0;
 
-        return sprintf(page, "%u\n", reg->hr_task->pid);
+        return sprintf(page, "%u\n", pid);
 }
 
 struct o2hb_region_attribute {
@@ -1495,13 +1511,17 @@ out:
 static void o2hb_heartbeat_group_drop_item(struct config_group *group,
                                            struct config_item *item)
 {
+        struct task_struct *hb_task;
         struct o2hb_region *reg = to_o2hb_region(item);
 
         /* stop the thread when the user removes the region dir */
-        if (reg->hr_task) {
-                kthread_stop(reg->hr_task);
-                reg->hr_task = NULL;
-        }
+        spin_lock(&o2hb_live_lock);
+        hb_task = reg->hr_task;
+        reg->hr_task = NULL;
+        spin_unlock(&o2hb_live_lock);
+
+        if (hb_task)
+                kthread_stop(hb_task);
 
         config_item_put(item);
 }