From a261ad64d409fcc06a2fed1a43d937fbb843c7f9 Mon Sep 17 00:00:00 2001 From: Thomas Tai Date: Wed, 22 Mar 2017 10:52:11 -0700 Subject: [PATCH] gfs2: fix slab corruption during mounting and umounting gfs file system During mounting and unmounting GFS2 file system, kernel panic happens due to slab memory corruption. The slab allocator suggests that it is likely a double free memory corrruption. The issue is traced back to v3.9-rc6 where a patch is submitted to use kzalloc() for storing a bitmap instead of using a local variable. The intention is to allocate memory during mounting and to free memory during unmounting. The original patch misses a code path which has already freed the memory and caused memory corruption. This patch sets the memory pointer to NULL after the memory is freed, so that double free memory corruption will not be happened. gdlm_mount() '-- set_recover_size() which use kzalloc() '-- if dlm does not support ops callbacks then '--- free_recover_size() which use kfree() gldm_unmount() '-- free_recover_size() which use kfree() previous patch which introduce the double free issue is commit 57c7310b8eb9 ("GFS2: use kmalloc for lvb bitmap") orabug: 25253085 orabug: 25791662 Signed-off-by: Thomas Tai Reviewed-by: Liam R. Howlett --- fs/gfs2/lock_dlm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c index 641383a9c1bb..3b2bbccd3c88 100644 --- a/fs/gfs2/lock_dlm.c +++ b/fs/gfs2/lock_dlm.c @@ -1058,6 +1058,7 @@ static void free_recover_size(struct lm_lockstruct *ls) ls->ls_recover_submit = NULL; ls->ls_recover_result = NULL; ls->ls_recover_size = 0; + ls->ls_lvb_bits = NULL; } /* dlm calls before it does lock recovery */ -- 2.50.1