Bob Peterson 9290a9a7c0 GFS2: Fix use-after-free race when calling gfs2_remove_from_ail ... Function gfs2_remove_from_ail drops the reference on the bh via brelse. This patch fixes a race condition whereby bh is deferenced after the brelse when setting bd->bd_blkno = bh->b_blocknr; Under certain rare circumstances, bh might be gone or reused, and bd->bd_blkno is set to whatever that memory happens to be, which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails the test "bd->bd_blkno >= blkno" which causes it to never be freed. The end result is that the bd is never freed from the bufdata cache, which results in this error: slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects Signed-off-by: Bob Peterson <rpeterso@redhat.com> Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>		2013-12-13 21:42:23 +00:00
..
acl.c
acl.h
aops.c
bmap.c
bmap.h
dentry.c
dir.c
dir.h
export.c
file.c
gfs2.h
glock.c
glock.h
glops.c
glops.h
incore.h
inode.c	GFS2: Fix ref count bug relating to atomic_open	2013-11-21 18:47:57 +00:00
inode.h
Kconfig
lock_dlm.c
log.c	GFS2: Fix use-after-free race when calling gfs2_remove_from_ail	2013-12-13 21:42:23 +00:00
log.h
lops.c
lops.h
main.c
Makefile
meta_io.c
meta_io.h
ops_fstype.c	GFS2: don't hold s_umount over blkdev_put	2013-12-13 21:42:03 +00:00
quota.c
quota.h
recovery.c
recovery.h
rgrp.c
rgrp.h
super.c
super.h
sys.c
sys.h
trace_gfs2.h
trans.c
trans.h
util.c
util.h
xattr.c
xattr.h