Re: [PATCH 5.4] gfs2: Don't deref jdesc in evict

[Greg KH <greg@kroah.com>]

On Wed, Jun 28, 2023 at 04:30:52PM +0300, Dragos-Marian Panait wrote:
> From: Bob Peterson <rpeterso@redhat.com>
> 
> [ Upstream commit 504a10d9e46bc37b23d0a1ae2f28973c8516e636 ]
> 
> On corrupt gfs2 file systems the evict code can try to reference the
> journal descriptor structure, jdesc, after it has been freed and set to
> NULL. The sequence of events is:
> 
> init_journal()
> ...
> fail_jindex:
>    gfs2_jindex_free(sdp); <------frees journals, sets jdesc = NULL
>       if (gfs2_holder_initialized(&ji_gh))
>          gfs2_glock_dq_uninit(&ji_gh);
> fail:
>    iput(sdp->sd_jindex); <--references jdesc in evict_linked_inode
>       evict()
>          gfs2_evict_inode()
>             evict_linked_inode()
>                ret = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
> <------references the now freed/zeroed sd_jdesc pointer.
> 
> The call to gfs2_trans_begin is done because the truncate_inode_pages
> call can cause gfs2 events that require a transaction, such as removing
> journaled data (jdata) blocks from the journal.
> 
> This patch fixes the problem by adding a check for sdp->sd_jdesc to
> function gfs2_evict_inode. In theory, this should only happen to corrupt
> gfs2 file systems, when gfs2 detects the problem, reports it, then tries
> to evict all the system inodes it has read in up to that point.
> 
> Reported-by: Yang Lan <lanyang0908@gmail.com>
> Signed-off-by: Bob Peterson <rpeterso@redhat.com>
> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
> [DP: adjusted context]
> Signed-off-by: Dragos-Marian Panait <dragos.panait@windriver.com>
> ---
>  fs/gfs2/super.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

All now queued up, thanks.

greg k-h