[Cluster-devel] [GFS2 PATCH] GFS2: Fix use-after-free race when calling gfs2_remove_from_ail

[Cluster-devel] [GFS2 PATCH] GFS2: Fix use-after-free race when calling gfs2_remove_from_ail

[Bob Peterson]

Hi,

Function gfs2_remove_from_ail drops the reference on the bh via
brelse. This patch fixes a race condition whereby bh is deferenced
after the brelse when setting bd->bd_blkno = bh->b_blocknr;
Under certain rare circumstances, bh might be gone or reused,
and bd->bd_blkno is set to whatever that memory happens to be,
which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails
the test "bd->bd_blkno >= blkno" which causes it to never be freed.
The end result is that the bd is never freed from the bufdata cache,
which results in this error:
slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects

Regards,

Bob Peterson
Red Hat File Systems

Signed-off-by: Bob Peterson <rpeterso@redhat.com> 
---
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 610613f..9dcb977 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -551,10 +551,10 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
 	struct buffer_head *bh = bd->bd_bh;
 	struct gfs2_glock *gl = bd->bd_gl;
 
-	gfs2_remove_from_ail(bd);
-	bd->bd_bh = NULL;
 	bh->b_private = NULL;
 	bd->bd_blkno = bh->b_blocknr;
+	gfs2_remove_from_ail(bd); /* drops ref on bh */
+	bd->bd_bh = NULL;
 	bd->bd_ops = &gfs2_revoke_lops;
 	sdp->sd_log_num_revoke++;
 	atomic_inc(&gl->gl_revokes);

[Cluster-devel] [GFS2 PATCH] GFS2: Fix use-after-free race when calling gfs2_remove_from_ail

[Steven Whitehouse]

Hi,

Thanks. I've pushed it to the -nmw tree,

Steve.

On Tue, 2013-12-10 at 12:06 -0500, Bob Peterson wrote:
> Hi,
> 
> Function gfs2_remove_from_ail drops the reference on the bh via
> brelse. This patch fixes a race condition whereby bh is deferenced
> after the brelse when setting bd->bd_blkno = bh->b_blocknr;
> Under certain rare circumstances, bh might be gone or reused,
> and bd->bd_blkno is set to whatever that memory happens to be,
> which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails
> the test "bd->bd_blkno >= blkno" which causes it to never be freed.
> The end result is that the bd is never freed from the bufdata cache,
> which results in this error:
> slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects
> 
> Regards,
> 
> Bob Peterson
> Red Hat File Systems
> 
> Signed-off-by: Bob Peterson <rpeterso@redhat.com> 
> ---
> diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
> index 610613f..9dcb977 100644
> --- a/fs/gfs2/log.c
> +++ b/fs/gfs2/log.c
> @@ -551,10 +551,10 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
>  	struct buffer_head *bh = bd->bd_bh;
>  	struct gfs2_glock *gl = bd->bd_gl;
>  
> -	gfs2_remove_from_ail(bd);
> -	bd->bd_bh = NULL;
>  	bh->b_private = NULL;
>  	bd->bd_blkno = bh->b_blocknr;
> +	gfs2_remove_from_ail(bd); /* drops ref on bh */
> +	bd->bd_bh = NULL;
>  	bd->bd_ops = &gfs2_revoke_lops;
>  	sdp->sd_log_num_revoke++;
>  	atomic_inc(&gl->gl_revokes);
>