fs/mbcache: fix use after free issue in mb_cache_shrink_scan()

Fix the below potential race between these two contexts -
mb_cache_entry_get() and mb_cache_shrink_scan(), which results
into use after free issue.

			     task a:
			     mb_cache_shrink_scan()
			       |--if(!list_empty(&mb_cache_lru_list))
				      |--get the ce entry
				      |--list_del_init(&ce->e_lru_list);
				      |--check ce->e_used, ce->e_queued,
					 ce->e_refcnt and continue
				      -> gets prempted here
task b:
ext4_xattr_release_block()
 |--mb_cache_entry_get()
    |--get ce from hlist_bl_for_each_entry()
      |--increment ce->e_used and
         list_del_init(&ce->e_lru_list)
 |--mb_cache_entry_free()
				      |--hlist_bl_lock(ce->e_block_hash_p);
				      -> results into use after free

Also, fix similar potential race between mb_cache_entry_alloc() and
mb_cache_entry_get() in case if cache->c_max_entries is reached.

Change-Id: I01049bae5d914cfb8494ab299ec2e068745d1110
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>

0 files changed, 0 insertions, 0 deletions