debugobjects: Stop accessing objects after releasing hash bucket lock
authorAndrzej Hajda <andrzej.hajda@intel.com>
Wed, 25 Oct 2023 21:39:07 +0000 (23:39 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 5 Feb 2024 20:14:14 +0000 (20:14 +0000)
commitd396f97648bfd60cec17e1ac11845cc8c8636a36
tree34c4fb816250cb65c761bd6a8e6a7a33ffb8c2c4
parent814173380135834d8e520cb2fa45951205744cf3
debugobjects: Stop accessing objects after releasing hash bucket lock

[ Upstream commit 9bb6362652f3f4d74a87d572a91ee1b38e673ef6 ]

After release of the hashbucket lock the tracking object can be modified or
freed by a concurrent thread.  Using it in such a case is error prone, even
for printing the object state:

    1. T1 tries to deactivate destroyed object, debugobjects detects it,
       hash bucket lock is released.

    2. T2 preempts T1 and frees the tracking object.

    3. The freed tracking object is allocated and initialized for a
       different to be tracked kernel object.

    4. T1 resumes and reports error for wrong kernel object.

Create a local copy of the tracking object before releasing the hash bucket
lock and use the local copy for reporting and fixups to prevent this.

Signed-off-by: Andrzej Hajda <andrzej.hajda@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20231025-debugobjects_fix-v3-1-2bc3bf7084c2@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
lib/debugobjects.c