Commit 3af165ac authored by Steven Whitehouse's avatar Steven Whitehouse
Browse files

GFS2: Fix use-after-free bug on umount 



There was a use-after-free with the GFS2 super block during
umount. This patch moves almost all of the umount code from
->put_super into ->kill_sb, the only bit that cannot be moved
being the glock hash clearing which has to remain as ->put_super
due to umount ordering requirements. As a result its now obvious
that the kfree is the final operation, whereas before it was
hidden in ->put_super.

Also gfs2_jindex_free is then only referenced from a single file
so thats moved and marked static too.

Signed-off-by: default avatarSteven Whitehouse <swhiteho@redhat.com>
parent 2e204703

fs/gfs2/glock.c

+2 −1
Original line number Diff line number Diff line
@@ -1547,8 +1547,9 @@ static void clear_glock(struct gfs2_glock *gl) 
 * Called when unmounting the filesystem.

 */



void gfs2_gl_hash_clear(struct gfs2_sbd *sdp)

void gfs2_gl_hash_clear(struct super_block *sb)

{

	struct gfs2_sbd *sdp = sb->s_fs_info;

	unsigned long t;

	unsigned int x;

	int cont;

fs/gfs2/glock.h

+1 −1
Original line number Diff line number Diff line
@@ -130,7 +130,7 @@ void gfs2_lvb_unhold(struct gfs2_glock *gl); 


void gfs2_glock_cb(void *cb_data, unsigned int type, void *data);

void gfs2_reclaim_glock(struct gfs2_sbd *sdp);

void gfs2_gl_hash_clear(struct gfs2_sbd *sdp);

void gfs2_gl_hash_clear(struct super_block *sb);

void gfs2_glock_finish_truncate(struct gfs2_inode *ip);



int __init gfs2_glock_init(void);

fs/gfs2/ops_fstype.c

+88 −10
Original line number Diff line number Diff line
@@ -705,6 +705,40 @@ static int gfs2_jindex_hold(struct gfs2_sbd *sdp, struct gfs2_holder *ji_gh) 
	return error;

}



/**

 * gfs2_jindex_free - Clear all the journal index information

 * @sdp: The GFS2 superblock

 *

 */



static void gfs2_jindex_free(struct gfs2_sbd *sdp)

{

	struct list_head list, *head;

	struct gfs2_jdesc *jd;

	struct gfs2_journal_extent *jext;



	spin_lock(&sdp->sd_jindex_spin);

	list_add(&list, &sdp->sd_jindex_list);

	list_del_init(&sdp->sd_jindex_list);

	sdp->sd_journals = 0;

	spin_unlock(&sdp->sd_jindex_spin);



	while (!list_empty(&list)) {

		jd = list_entry(list.next, struct gfs2_jdesc, jd_list);

		head = &jd->extent_list;

		while (!list_empty(head)) {

			jext = list_entry(head->next,

					  struct gfs2_journal_extent,

					  extent_list);

			list_del(&jext->extent_list);

			kfree(jext);

		}

		list_del(&jd->jd_list);

		iput(jd->jd_inode);

		kfree(jd);

	}

}



static int init_journal(struct gfs2_sbd *sdp, int undo)

{

	struct inode *master = sdp->sd_master_dir->d_inode;
@@ -1203,7 +1237,7 @@ fail_sb: 
fail_locking:

	init_locking(sdp, &mount_gh, UNDO);

fail_lm:

	gfs2_gl_hash_clear(sdp);

	gfs2_gl_hash_clear(sb);

	gfs2_lm_unmount(sdp);

	while (invalidate_inodes(sb))

		yield();
@@ -1263,17 +1297,61 @@ static int gfs2_get_sb_meta(struct file_system_type *fs_type, int flags, 
static void gfs2_kill_sb(struct super_block *sb)

{

	struct gfs2_sbd *sdp = sb->s_fs_info;

	if (sdp) {



	if (sdp == NULL) {

		kill_block_super(sb);

		return;

	}

	gfs2_meta_syncfs(sdp);

	dput(sdp->sd_root_dir);

	dput(sdp->sd_master_dir);

	sdp->sd_root_dir = NULL;

	sdp->sd_master_dir = NULL;



	/*  Unfreeze the filesystem, if we need to  */

	mutex_lock(&sdp->sd_freeze_lock);

	if (sdp->sd_freeze_count)

		gfs2_glock_dq_uninit(&sdp->sd_freeze_gh);

	mutex_unlock(&sdp->sd_freeze_lock);



	kthread_stop(sdp->sd_quotad_process);

	kthread_stop(sdp->sd_logd_process);

	kthread_stop(sdp->sd_recoverd_process);



	if (!(sb->s_flags & MS_RDONLY)) {

		int error = gfs2_make_fs_ro(sdp);

		if (error)

			gfs2_io_error(sdp);

	}



	/* At this point, we're through modifying the disk */

	gfs2_jindex_free(sdp);

	gfs2_clear_rgrpd(sdp);

	iput(sdp->sd_jindex);

	iput(sdp->sd_inum_inode);

	iput(sdp->sd_statfs_inode);

	iput(sdp->sd_rindex);

	iput(sdp->sd_quota_inode);



	gfs2_glock_put(sdp->sd_rename_gl);

	gfs2_glock_put(sdp->sd_trans_gl);



	if (!sdp->sd_args.ar_spectator) {

		gfs2_glock_dq_uninit(&sdp->sd_journal_gh);

		gfs2_glock_dq_uninit(&sdp->sd_jinode_gh);

		gfs2_glock_dq_uninit(&sdp->sd_ir_gh);

		gfs2_glock_dq_uninit(&sdp->sd_sc_gh);

		gfs2_glock_dq_uninit(&sdp->sd_qc_gh);

		iput(sdp->sd_ir_inode);

		iput(sdp->sd_sc_inode);

		iput(sdp->sd_qc_inode);

	}

	shrink_dcache_sb(sb);

	gfs2_glock_dq_uninit(&sdp->sd_live_gh);

	kill_block_super(sb);

	if (sdp)

	gfs2_lm_unmount(sdp);

	gfs2_sys_fs_del(sdp);

	gfs2_delete_debugfs_file(sdp);

	kfree(sdp);

}



struct file_system_type gfs2_fs_type = {

fs/gfs2/ops_super.c

+2 −66
Original line number Diff line number Diff line
@@ -95,7 +95,7 @@ do_flush: 
 * Returns: errno

 */



static int gfs2_make_fs_ro(struct gfs2_sbd *sdp)

int gfs2_make_fs_ro(struct gfs2_sbd *sdp)

{

	struct gfs2_holder t_gh;

	int error;
@@ -121,70 +121,6 @@ static int gfs2_make_fs_ro(struct gfs2_sbd *sdp) 
	return error;

}



/**

 * gfs2_put_super - Unmount the filesystem

 * @sb: The VFS superblock

 *

 */



static void gfs2_put_super(struct super_block *sb)

{

	struct gfs2_sbd *sdp = sb->s_fs_info;

	int error;



	/*  Unfreeze the filesystem, if we need to  */



	mutex_lock(&sdp->sd_freeze_lock);

	if (sdp->sd_freeze_count)

		gfs2_glock_dq_uninit(&sdp->sd_freeze_gh);

	mutex_unlock(&sdp->sd_freeze_lock);



	kthread_stop(sdp->sd_quotad_process);

	kthread_stop(sdp->sd_logd_process);

	kthread_stop(sdp->sd_recoverd_process);



	if (!(sb->s_flags & MS_RDONLY)) {

		error = gfs2_make_fs_ro(sdp);

		if (error)

			gfs2_io_error(sdp);

	}

	/*  At this point, we're through modifying the disk  */



	/*  Release stuff  */



	iput(sdp->sd_jindex);

	iput(sdp->sd_inum_inode);

	iput(sdp->sd_statfs_inode);

	iput(sdp->sd_rindex);

	iput(sdp->sd_quota_inode);



	gfs2_glock_put(sdp->sd_rename_gl);

	gfs2_glock_put(sdp->sd_trans_gl);



	if (!sdp->sd_args.ar_spectator) {

		gfs2_glock_dq_uninit(&sdp->sd_journal_gh);

		gfs2_glock_dq_uninit(&sdp->sd_jinode_gh);

		gfs2_glock_dq_uninit(&sdp->sd_ir_gh);

		gfs2_glock_dq_uninit(&sdp->sd_sc_gh);

		gfs2_glock_dq_uninit(&sdp->sd_qc_gh);

		iput(sdp->sd_ir_inode);

		iput(sdp->sd_sc_inode);

		iput(sdp->sd_qc_inode);

	}



	gfs2_glock_dq_uninit(&sdp->sd_live_gh);

	gfs2_clear_rgrpd(sdp);

	gfs2_jindex_free(sdp);

	/*  Take apart glock structures and buffer lists  */

	gfs2_gl_hash_clear(sdp);

	/*  Unmount the locking protocol  */

	gfs2_lm_unmount(sdp);



	/*  At this point, we're through participating in the lockspace  */

	gfs2_sys_fs_del(sdp);

	kfree(sdp);

}



/**

 * gfs2_write_super

 * @sb: the superblock
@@ -686,7 +622,7 @@ const struct super_operations gfs2_super_ops = { 
	.destroy_inode		= gfs2_destroy_inode,

	.write_inode		= gfs2_write_inode,

	.delete_inode		= gfs2_delete_inode,

	.put_super		= gfs2_put_super,

	.put_super		= gfs2_gl_hash_clear,

	.write_super		= gfs2_write_super,

	.sync_fs		= gfs2_sync_fs,

	.write_super_lockfs 	= gfs2_write_super_lockfs,

fs/gfs2/super.c

+0 −34
Original line number Diff line number Diff line
@@ -33,40 +33,6 @@ 
#include "trans.h"

#include "util.h"



/**

 * gfs2_jindex_free - Clear all the journal index information

 * @sdp: The GFS2 superblock

 *

 */



void gfs2_jindex_free(struct gfs2_sbd *sdp)

{

	struct list_head list, *head;

	struct gfs2_jdesc *jd;

	struct gfs2_journal_extent *jext;



	spin_lock(&sdp->sd_jindex_spin);

	list_add(&list, &sdp->sd_jindex_list);

	list_del_init(&sdp->sd_jindex_list);

	sdp->sd_journals = 0;

	spin_unlock(&sdp->sd_jindex_spin);



	while (!list_empty(&list)) {

		jd = list_entry(list.next, struct gfs2_jdesc, jd_list);

		head = &jd->extent_list;

		while (!list_empty(head)) {

			jext = list_entry(head->next,

					  struct gfs2_journal_extent,

					  extent_list);

			list_del(&jext->extent_list);

			kfree(jext);

		}

		list_del(&jd->jd_list);

		iput(jd->jd_inode);

		kfree(jd);

	}

}



static struct gfs2_jdesc *jdesc_find_i(struct list_head *head, unsigned int jid)

{

	struct gfs2_jdesc *jd;

CRA Git | Maintained and supported by SUSTech CRA and CCSE