gfs2: fix slab corruption during mounting and umounting gfs file system

During mounting and unmounting GFS2 file system, kernel panic happens
due to slab memory corruption. The slab allocator suggests that it is
likely a double free memory corrruption. The issue is traced back to
v3.9-rc6 where a patch is submitted to use kzalloc() for storing a
bitmap instead of using a local variable. The intention is to allocate
memory during mounting and to free memory during unmounting. The original
patch misses a code path which has already freed the memory and caused
memory corruption. This patch sets the memory pointer to NULL after
the memory is freed, so that double free memory corruption will not
be happened.

gdlm_mount()
  '-- set_recover_size() which use kzalloc()
  '-- if dlm does not support ops callbacks then
          '--- free_recover_size() which use kfree()

gldm_unmount()
  '-- free_recover_size() which use kfree()

previous patch which introduce the double free issue is
commit 57c7310b8eb9 ("GFS2: use kmalloc for lvb bitmap")

orabug: 25253085
orabug: 25791662

Signed-off-by: Thomas Tai <thomas.tai@oracle.com>
Reviewed-by: Liam R. Howlett <Liam.Howlett@Oracle.com>

diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 641383a9c1bbf5a346315ad3a4805b2ffaf788b4..3b2bbccd3c88013990d5e5db7c4cabe6a539eaef 100644 (file)
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -1058,6 +1058,7 @@ static void free_recover_size(struct lm_lockstruct *ls)
        ls->ls_recover_submit = NULL;
        ls->ls_recover_result = NULL;
        ls->ls_recover_size = 0;
+       ls->ls_lvb_bits = NULL;
 }
 
 /* dlm calls before it does lock recovery */