Bob Peterson 9290a9a7c0 GFS2: Fix use-after-free race when calling gfs2_remove_from_ail
Function gfs2_remove_from_ail drops the reference on the bh via
brelse. This patch fixes a race condition whereby bh is deferenced
after the brelse when setting bd->bd_blkno = bh->b_blocknr;
Under certain rare circumstances, bh might be gone or reused,
and bd->bd_blkno is set to whatever that memory happens to be,
which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails
the test "bd->bd_blkno >= blkno" which causes it to never be freed.
The end result is that the bd is never freed from the bufdata cache,
which results in this error:
slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
2013-12-13 21:42:23 +00:00
..
2013-10-24 23:43:27 -04:00
2013-11-13 12:09:12 +09:00
2013-06-29 12:56:53 +04:00
2013-10-27 16:27:07 -07:00
2013-09-16 18:20:25 -07:00
2013-11-16 13:14:56 -08:00
2013-06-29 12:56:32 +04:00
2013-11-09 00:16:32 -05:00
2013-06-29 12:56:39 +04:00
2013-06-29 12:56:29 +04:00
2013-11-22 08:37:47 -08:00
2013-11-22 08:42:14 -08:00
2013-06-29 12:57:04 +04:00
2013-10-24 23:34:54 -04:00
2013-04-29 15:40:23 -04:00
2013-09-13 23:06:40 -04:00
2013-10-24 23:34:54 -04:00
2013-06-29 12:57:05 +04:00
2013-03-03 23:00:23 -05:00
2013-09-10 18:56:31 -04:00
2013-10-24 23:34:54 -04:00
2013-11-09 00:16:20 -05:00
2013-10-24 23:34:54 -04:00
2013-04-17 13:25:09 +01:00
2013-11-09 00:16:19 -05:00
2013-11-09 00:16:19 -05:00
2013-05-07 20:16:25 -07:00
2013-10-24 23:35:00 -04:00
2013-10-24 23:34:54 -04:00
2013-10-24 23:34:54 -04:00
2013-10-24 23:34:54 -04:00
2013-11-09 00:16:31 -05:00
2013-11-09 00:16:20 -05:00
2013-05-29 12:57:34 -07:00