• Thomas Tai's avatar
    gfs2: fix slab corruption during mounting and umounting gfs file system · cc1dfa8b
    Thomas Tai authored
    When using cman-3.0.12.1 and gfs2-utils-3.0.12.1, mounting and
    unmounting GFS2 file system would cause kernel to hang. The slab
    allocator suggests that it is likely a double free memory corruption.
    The issue is traced back to v3.9-rc6 where a patch is submitted to
    use kzalloc() for storing a bitmap instead of using a local variable.
    The intention is to allocate memory during mount and to free memory
    during unmount. The original patch misses a code path which has
    already freed the memory and caused memory corruption. This patch sets
    the memory pointer to NULL after the memory is freed, so that double
    free memory corruption will not happen.
    
    gdlm_mount()
      '-- set_recover_size() which use kzalloc()
      '-- if dlm does not support ops callbacks then
              '--- free_recover_size() which use kfree()
    
    gldm_unmount()
      '-- free_recover_size() which use kfree()
    
    Previous patch which introduced the double free issue is
    commit 57c7310b ("GFS2: use kmalloc for lvb bitmap")
    Signed-off-by: default avatarThomas Tai <thomas.tai@oracle.com>
    Signed-off-by: default avatarBob Peterson <rpeterso@redhat.com>
    Reviewed-by: default avatarLiam R. Howlett <Liam.Howlett@Oracle.com>
    cc1dfa8b
lock_dlm.c 38.7 KB