Bob Peterson 9290a9a7c0
GFS2: Fix use-after-free race when calling gfs2_remove_from_ail ...
Function gfs2_remove_from_ail drops the reference on the bh via
brelse. This patch fixes a race condition whereby bh is deferenced
after the brelse when setting bd->bd_blkno = bh->b_blocknr;
Under certain rare circumstances, bh might be gone or reused,
and bd->bd_blkno is set to whatever that memory happens to be,
which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails
the test "bd->bd_blkno >= blkno" which causes it to never be freed.
The end result is that the bd is never freed from the bufdata cache,
which results in this error:
slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects
Signed-off-by: Bob Peterson <rpeterso@redhat.com >
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com >
2013-12-13 21:42:23 +00:00
2013-11-15 22:04:17 -05:00
2013-10-24 23:43:27 -04:00
2013-09-12 15:38:02 -07:00
2013-10-28 19:36:46 -04:00
2013-10-24 23:43:27 -04:00
2013-10-24 23:34:50 -04:00
2013-09-12 15:38:02 -07:00
2013-11-22 08:38:55 -08:00
2013-11-13 15:34:18 +09:00
2013-09-27 18:40:25 +01:00
2013-11-16 16:19:31 -08:00
2013-11-09 00:16:21 -05:00
2013-11-21 16:42:27 -08:00
2013-11-13 12:09:12 +09:00
2013-11-13 12:09:24 +09:00
2013-11-13 12:09:36 +09:00
2013-11-19 16:39:05 -05:00
2013-11-22 10:58:14 -08:00
2013-11-15 22:04:17 -05:00
2013-08-24 12:10:22 -04:00
2013-09-12 15:38:02 -07:00
2013-11-09 00:16:38 -05:00
2013-11-05 11:26:47 +01:00
2013-11-13 15:25:47 +09:00
2013-11-14 17:19:58 +09:00
2013-11-11 09:36:32 +09:00
2013-10-24 23:43:28 -04:00
2013-06-29 12:56:53 +04:00
2013-11-14 12:08:14 +09:00
2013-11-13 15:34:18 +09:00
2013-12-13 21:42:23 +00:00
2013-11-13 12:09:32 +09:00
2013-11-15 09:32:23 +09:00
2013-11-15 22:04:17 -05:00
2013-11-09 00:16:44 -05:00
2013-07-03 16:07:41 -07:00
2013-08-24 12:10:17 -04:00
2013-10-24 23:34:59 -04:00
2013-10-31 20:37:15 +01:00
2013-08-28 14:59:58 -04:00
2013-10-27 16:27:07 -07:00
2013-10-22 09:01:11 +01:00
2013-08-05 15:03:46 -04:00
2013-07-02 09:39:34 -07:00
2013-09-16 18:20:25 -07:00
2013-10-24 23:43:28 -04:00
2013-11-16 13:14:56 -08:00
2013-11-19 18:06:54 -05:00
2013-09-30 14:31:02 -07:00
2013-07-09 10:33:20 -07:00
2013-11-09 00:16:31 -05:00
2013-11-15 09:32:21 +09:00
2013-09-12 15:38:02 -07:00
2013-06-29 12:56:32 +04:00
2013-11-21 19:18:14 -08:00
2013-09-16 09:28:29 -07:00
2013-11-09 00:16:32 -05:00
2013-06-29 12:56:39 +04:00
2013-11-19 16:39:06 -05:00
2013-09-11 15:59:37 -07:00
2013-09-24 11:24:21 +02:00
2013-06-29 12:56:29 +04:00
2013-11-20 03:59:20 +00:00
2013-11-07 20:47:28 +09:00
2013-09-29 22:02:02 -04:00
2013-11-13 15:34:18 +09:00
2013-10-18 22:39:07 +02:00
2013-09-12 15:38:02 -07:00
2013-11-22 08:37:47 -08:00
2013-11-22 08:42:14 -08:00
2013-11-09 00:16:28 -05:00
2013-11-09 00:16:44 -05:00
2013-06-29 12:57:04 +04:00
2013-11-09 00:16:26 -05:00
2013-11-09 00:16:30 -05:00
2013-11-09 00:16:30 -05:00
2013-10-24 23:34:54 -04:00
2013-09-22 15:00:11 -07:00
2013-11-18 12:31:27 -07:00
2013-09-13 23:06:40 -04:00
2013-10-16 21:35:53 -07:00
2013-11-14 12:08:14 +09:00
2013-10-24 23:34:54 -04:00
2013-06-29 12:57:05 +04:00
2013-11-15 22:04:09 -05:00
2013-11-15 22:04:17 -05:00
2013-09-09 10:47:42 -07:00
2013-09-10 18:56:31 -04:00
2013-11-13 15:45:43 +09:00
2013-11-21 19:18:14 -08:00
2013-10-24 23:34:54 -04:00
2013-11-13 15:34:18 +09:00
2013-11-06 12:40:26 +01:00
2013-11-13 15:45:43 +09:00
2013-11-09 00:16:44 -05:00
2013-11-09 00:16:20 -05:00
2013-10-24 23:34:54 -04:00
2013-11-15 22:04:17 -05:00
2013-11-13 07:30:53 -05:00
2013-09-10 18:56:31 -04:00
2013-11-09 00:16:19 -05:00
2013-11-21 19:18:14 -08:00
2013-11-09 00:16:19 -05:00
2013-11-09 00:16:44 -05:00
2013-10-24 23:35:00 -04:00
2013-08-26 18:42:15 -07:00
2013-10-24 23:34:59 -04:00
2013-10-24 23:34:54 -04:00
2013-10-24 23:34:54 -04:00
2013-11-13 15:34:18 +09:00
2013-11-18 19:07:53 -08:00
2013-10-24 23:34:54 -04:00
2013-11-09 00:16:31 -05:00
2013-10-12 13:12:31 -07:00
2013-11-09 00:16:20 -05:00
2013-11-13 15:45:43 +09:00
2013-11-09 00:16:44 -05:00
9290a9a7c0