summaryrefslogtreecommitdiffstats
path: root/fs/gfs2/meta_io.c
diff options
context:
space:
mode:
authorBob Peterson <rpeterso@redhat.com>2013-12-10 18:06:35 +0100
committerSteven Whitehouse <swhiteho@redhat.com>2013-12-13 22:42:23 +0100
commit9290a9a7c0bcf5400e8dbfbf9707fa68ea3fb338 (patch)
tree93b5b33720730b873652bec3ee4b761cfe844845 /fs/gfs2/meta_io.c
parentGFS2: don't hold s_umount over blkdev_put (diff)
downloadlinux-9290a9a7c0bcf5400e8dbfbf9707fa68ea3fb338.tar.xz
linux-9290a9a7c0bcf5400e8dbfbf9707fa68ea3fb338.zip
GFS2: Fix use-after-free race when calling gfs2_remove_from_ail
Function gfs2_remove_from_ail drops the reference on the bh via brelse. This patch fixes a race condition whereby bh is deferenced after the brelse when setting bd->bd_blkno = bh->b_blocknr; Under certain rare circumstances, bh might be gone or reused, and bd->bd_blkno is set to whatever that memory happens to be, which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails the test "bd->bd_blkno >= blkno" which causes it to never be freed. The end result is that the bd is never freed from the bufdata cache, which results in this error: slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects Signed-off-by: Bob Peterson <rpeterso@redhat.com> Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
Diffstat (limited to 'fs/gfs2/meta_io.c')
0 files changed, 0 insertions, 0 deletions