From: Lachlan McIlroy <lachlan@sgi.com>
To: xfs-dev <xfs-dev@sgi.com>, xfs-oss <xfs@oss.sgi.com>
Subject: [PATCH] Fix use-after-free with log and quotas
Date: Fri, 12 Sep 2008 18:41:07 +1000 [thread overview]
Message-ID: <48CA2B23.4020405@sgi.com> (raw)
Destroying the quota stuff on unmount can access the log - ie XFS_QM_DONE()
ends up in xfs_dqunlock() which calls xfs_trans_unlocked_item() and then
xfs_log_move_tail(). By this time the log has already been destroyed.
Just move the cleanup of the quota code earlier in xfs_unmountfs() before
the call to xfs_log_unmount(). Moving XFS_QM_DONE() up near
XFS_QM_DQPURGEALL() seems like a good spot.
--- a/fs/xfs/xfs_mount.c 2008-09-12 18:24:09.000000000 +1000
+++ b/fs/xfs/xfs_mount.c 2008-09-12 18:31:22.000000000 +1000
@@ -1245,6 +1245,9 @@ xfs_unmountfs(
XFS_QM_DQPURGEALL(mp, XFS_QMOPT_QUOTALL | XFS_QMOPT_UMOUNTING);
+ if (mp->m_quotainfo)
+ XFS_QM_DONE(mp);
+
/*
* Flush out the log synchronously so that we know for sure
* that nothing is pinned. This is important because bflush()
@@ -1297,8 +1300,6 @@ xfs_unmountfs(
xfs_errortag_clearall(mp, 0);
#endif
xfs_free_perag(mp);
- if (mp->m_quotainfo)
- XFS_QM_DONE(mp);
}
STATIC void
next reply other threads:[~2008-09-12 8:33 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-09-12 8:41 Lachlan McIlroy [this message]
2008-09-12 8:43 ` [PATCH] Fix use-after-free with log and quotas Christoph Hellwig
2008-09-13 4:02 ` Dave Chinner
2008-09-15 2:40 ` Lachlan McIlroy
2008-09-16 4:08 ` Dave Chinner
2008-09-16 6:36 ` Lachlan McIlroy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=48CA2B23.4020405@sgi.com \
--to=lachlan@sgi.com \
--cc=xfs-dev@sgi.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.