diff options
author | Bob Peterson <rpeterso@redhat.com> | 2013-12-10 17:06:35 (GMT) |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-01-09 20:25:15 (GMT) |
commit | 6d9c4a00e9d7c4506f29b94c85b07d815cc11b8a (patch) | |
tree | 4dd99d8144853f8adf52bca460a2c0847aacfc38 /fs/gfs2/rgrp.c | |
parent | c2ff1ad9bc31833dc738d077091e497f78e96255 (diff) | |
download | linux-fsl-qoriq-6d9c4a00e9d7c4506f29b94c85b07d815cc11b8a.tar.xz |
GFS2: Fix use-after-free race when calling gfs2_remove_from_ail
commit 9290a9a7c0bcf5400e8dbfbf9707fa68ea3fb338 upstream.
Function gfs2_remove_from_ail drops the reference on the bh via
brelse. This patch fixes a race condition whereby bh is deferenced
after the brelse when setting bd->bd_blkno = bh->b_blocknr;
Under certain rare circumstances, bh might be gone or reused,
and bd->bd_blkno is set to whatever that memory happens to be,
which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails
the test "bd->bd_blkno >= blkno" which causes it to never be freed.
The end result is that the bd is never freed from the bufdata cache,
which results in this error:
slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/gfs2/rgrp.c')
0 files changed, 0 insertions, 0 deletions