Commit 9290a9a7 authored Dec 10, 2013 by Bob Peterson Committed by Steven Whitehouse Dec 13, 2013

GFS2: Fix use-after-free race when calling gfs2_remove_from_ail



Function gfs2_remove_from_ail drops the reference on the bh via
brelse. This patch fixes a race condition whereby bh is deferenced
after the brelse when setting bd->bd_blkno = bh->b_blocknr;
Under certain rare circumstances, bh might be gone or reused,
and bd->bd_blkno is set to whatever that memory happens to be,
which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails
the test "bd->bd_blkno >= blkno" which causes it to never be freed.
The end result is that the bd is never freed from the bufdata cache,
which results in this error:
slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

parent dfe5b9ad

fs/gfs2/log.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -551,10 +551,10 @@ void gfs2_add_revoke(struct gfs2_sbd sdp, struct gfs2_bufdata bd)
		struct buffer_head *bh = bd->bd_bh;
		struct gfs2_glock *gl = bd->bd_gl;

		gfs2_remove_from_ail(bd);
		bd->bd_bh = NULL;
		bh->b_private = NULL;
		bd->bd_blkno = bh->b_blocknr;
		gfs2_remove_from_ail(bd); /* drops ref on bh */
		bd->bd_bh = NULL;
		bd->bd_ops = &gfs2_revoke_lops;
		sdp->sd_log_num_revoke++;
		atomic_inc(&gl->gl_revokes);