linux-hardened/fs/gfs2
Bob Peterson 36e4ad0316 GFS2: don't set rgrp gl_object until it's inserted into rgrp tree
Before this patch, function read_rindex_entry would set a rgrp
glock's gl_object pointer to itself before inserting the rgrp into
the rgrp rbtree. The problem is: if another process was also reading
the rgrp in, and had already inserted its newly created rgrp, then
the second call to read_rindex_entry would overwrite that value,
then return a bad return code to the caller. Later, other functions
would reference the now-freed rgrp memory by way of gl_object.
In some cases, that could result in gfs2_rgrp_brelse being called
twice for the same rgrp: once for the failed attempt and once for
the "real" rgrp release. Eventually the kernel would panic.
There are also a number of other things that could go wrong when
a kernel module is accessing freed storage. For example, this could
result in rgrp corruption because the fake rgrp would point to a
fake bitmap in memory too, causing gfs2_inplace_reserve to search
some random memory for free blocks, and find some, since we were
never setting rgd->rd_bits to NULL before freeing it.

This patch fixes the problem by not setting gl_object until we
have successfully inserted the rgrp into the rbtree. Also, it sets
rd_bits to NULL as it frees them, which will ensure any accidental
access to the wrong rgrp will result in a kernel panic rather than
file system corruption, which is preferred.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
2016-06-10 07:01:58 -05:00
..
acl.c gfs2: Switch to generic xattr handlers 2016-05-12 22:28:05 -04:00
acl.h gfs2: Switch to generic xattr handlers 2016-05-12 22:28:05 -04:00
aops.c We've got nine patches this time: 2016-05-20 15:11:26 -07:00
bmap.c mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
bmap.h GFS2: Clean up journal extent mapping 2014-03-03 13:50:12 +00:00
dentry.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
dir.c GFS2: Eliminate parameter non_block on gfs2_inode_lookup 2016-03-15 10:46:50 -04:00
dir.h GFS2: Make rename not save dirent location 2014-10-01 14:06:15 +01:00
export.c GFS2: Don't filter out I_FREEING inodes anymore 2016-03-15 10:46:45 -04:00
file.c We've got nine patches this time: 2016-05-20 15:11:26 -07:00
gfs2.h [GFS2] Remove remote lock dropping code 2008-06-27 09:39:44 +01:00
glock.c We've got nine patches this time: 2016-05-20 15:11:26 -07:00
glock.h GFS2: Reduce size of incore inode 2015-12-14 12:19:24 -06:00
glops.c GFS2: Get rid of dead code in inode_go_demote_ok 2016-04-05 11:59:18 -04:00
glops.h GFS2: update freeze code to use freeze/thaw_super on all nodes 2014-11-17 10:36:39 +00:00
incore.h GFS2: Prevent delete work from occurring on glocks used for create 2016-03-15 10:46:37 -04:00
inode.c We've got nine patches this time: 2016-05-20 15:11:26 -07:00
inode.h GFS2: Eliminate parameter non_block on gfs2_inode_lookup 2016-03-15 10:46:50 -04:00
Kconfig Finally eradicate CONFIG_HOTPLUG 2013-06-03 14:20:18 -07:00
lock_dlm.c remove abs64() 2015-11-09 15:11:24 -08:00
log.c gfs2: clear journal live bit in gfs2_log_flush 2015-12-14 12:19:41 -06:00
log.h GFS2: remove transaction glock 2014-05-14 10:04:34 +01:00
lops.c GFS2: merge window 2015-09-11 12:23:51 -07:00
lops.h GFS2: Move log buffer lists into transaction 2014-02-24 16:54:54 +00:00
main.c kmemcg: account certain kmem allocations to memcg 2016-01-14 16:00:49 -08:00
Makefile GFS2: Rename ops_inode.c to inode.c 2011-05-10 13:12:49 +01:00
meta_io.c We've got nine patches this time: 2016-05-20 15:11:26 -07:00
meta_io.h GFS2: Refactor gfs2_remove_from_journal 2016-05-06 11:27:27 -05:00
ops_fstype.c parallel lookups: actual switch to rwsem 2016-05-02 19:49:28 -04:00
quota.c mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
quota.h GFS2: Make rgrp reservations part of the gfs2_inode structure 2015-12-14 12:16:38 -06:00
recovery.c GFS2: fix sprintf format specifier 2015-01-13 10:48:57 +00:00
recovery.h GFS2: Move recovery variables to journal structure in memory 2014-03-07 09:14:48 +00:00
rgrp.c GFS2: don't set rgrp gl_object until it's inserted into rgrp tree 2016-06-10 07:01:58 -05:00
rgrp.h GFS2: Make rgrp reservations part of the gfs2_inode structure 2015-12-14 12:16:38 -06:00
super.c don't bother with ->d_inode->i_sb - it's always equal to ->d_sb 2016-04-10 17:11:51 -04:00
super.h GFS2: update freeze code to use freeze/thaw_super on all nodes 2014-11-17 10:36:39 +00:00
sys.c gfs2: convert simple_str to kstr 2015-05-05 13:23:22 -05:00
sys.h GFS2: dlm based recovery coordination 2012-01-11 09:23:05 +00:00
trace_gfs2.h gfs2: Make statistics unsigned, suitable for use with do_div() 2015-09-03 13:33:32 -05:00
trans.c gfs2: Add missing else in trans_add_meta/data 2015-10-01 12:00:59 -05:00
trans.h GFS2: Split gfs2_trans_add_bh() into two 2013-01-29 10:28:04 +00:00
util.c GFS2: ignore unlock failures after withdraw 2016-03-24 08:28:48 -04:00
util.h GFS2: Make rgrp reservations part of the gfs2_inode structure 2015-12-14 12:16:38 -06:00
xattr.c gfs2: Switch to generic xattr handlers 2016-05-12 22:28:05 -04:00
xattr.h gfs2: Remove gfs2_xattr_acl_chmod 2015-12-06 21:25:17 -05:00