From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steven Whitehouse Date: Tue, 10 Dec 2013 17:09:10 +0000 Subject: [Cluster-devel] [GFS2 PATCH] GFS2: Fix use-after-free race when calling gfs2_remove_from_ail In-Reply-To: <2108655672.39417861.1386695195458.JavaMail.root@redhat.com> References: <2108655672.39417861.1386695195458.JavaMail.root@redhat.com> Message-ID: <1386695350.2723.0.camel@menhir> List-Id: To: cluster-devel.redhat.com MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi, Thanks. I've pushed it to the -nmw tree, Steve. On Tue, 2013-12-10 at 12:06 -0500, Bob Peterson wrote: > Hi, > > Function gfs2_remove_from_ail drops the reference on the bh via > brelse. This patch fixes a race condition whereby bh is deferenced > after the brelse when setting bd->bd_blkno = bh->b_blocknr; > Under certain rare circumstances, bh might be gone or reused, > and bd->bd_blkno is set to whatever that memory happens to be, > which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails > the test "bd->bd_blkno >= blkno" which causes it to never be freed. > The end result is that the bd is never freed from the bufdata cache, > which results in this error: > slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects > > Regards, > > Bob Peterson > Red Hat File Systems > > Signed-off-by: Bob Peterson > --- > diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c > index 610613f..9dcb977 100644 > --- a/fs/gfs2/log.c > +++ b/fs/gfs2/log.c > @@ -551,10 +551,10 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd) > struct buffer_head *bh = bd->bd_bh; > struct gfs2_glock *gl = bd->bd_gl; > > - gfs2_remove_from_ail(bd); > - bd->bd_bh = NULL; > bh->b_private = NULL; > bd->bd_blkno = bh->b_blocknr; > + gfs2_remove_from_ail(bd); /* drops ref on bh */ > + bd->bd_bh = NULL; > bd->bd_ops = &gfs2_revoke_lops; > sdp->sd_log_num_revoke++; > atomic_inc(&gl->gl_revokes); >