Attachment 838395 Details for Bug 516025 – RHEL5 patch to fix the problem

[patch] RHEL5 patch to fix the problem

bz516025.posted.patch (text/plain), 1.72 KB, created by Robert Peterson on 2013-12-18 15:26:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Robert Peterson

Created: 2013-12-18 15:26:16 UTC

Size: 1.72 KB

patch

obsolete

>commit b626ee66fcfa208520f3c11aa3057653a5027292
>Author: Bob Peterson <rpeterso@redhat.com>
>Date:   Wed Dec 18 08:43:15 2013 -0600
>
>    GFS2: Slab memory still in use after GFS2 unmount
>    
>    This patch is for bug #516025. It combines these two upstream patches:
>    
>    http://git.kernel.org/cgit/linux/kernel/git/steve/gfs2-3.0-nmw.git/commit/fs/gfs2?id=f46afaeb3a445439f61d2fc3ed351159dbb1eb77
>    http://git.kernel.org/cgit/linux/kernel/git/steve/gfs2-3.0-nmw.git/commit/fs/gfs2?id=8953e11bb1912ec2c8b9ba2591cd3630f81c83de
>    
>    The combined patch addresses two problems in function gfs2_remove_from_journal:
>    
>    (1) It fixes a use-after-free race when calling gfs2_remove_from_ail
>    (2) It fixes a slab memory leak in gfs2_bufdata
>    
>    rhbz#516025
>
>diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
>index bf1c017..1e293c0 100644
>--- a/fs/gfs2/meta_io.c
>+++ b/fs/gfs2/meta_io.c
>@@ -247,6 +247,8 @@ void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int
> {
> 	struct gfs2_sbd *sdp = GFS2_SB(bh->b_page->mapping->host);
> 	struct gfs2_bufdata *bd = bh->b_private;
>+	int was_pinned = 0;
>+
> 	if (test_clear_buffer_pinned(bh)) {
> 		list_del_init(&bd->bd_le.le_list);
> 		if (meta) {
>@@ -260,14 +262,18 @@ void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int
> 		}
> 		tr->tr_touched = 1;
> 		brelse(bh);
>+		was_pinned = 1;
> 	}
> 	if (bd) {
> 		if (bd->bd_ail) {
>-			gfs2_remove_from_ail(bd);
> 			bh->b_private = NULL;
>-			bd->bd_bh = NULL;
> 			bd->bd_blkno = bh->b_blocknr;
>+			gfs2_remove_from_ail(bd);
>+			bd->bd_bh = NULL;
> 			gfs2_trans_add_revoke(sdp, bd);
>+		} else if (was_pinned) {
>+			bh->b_private = NULL;
>+			kmem_cache_free(gfs2_bufdata_cachep, bd);
> 		}
> 	}
> 	clear_buffer_dirty(bh);

Actions: View | Diff

Attachments on bug 516025: 838395 | 916771 | 920713