GFS2: Add kobject release method

This patch adds a kobject release function that properly maintains
the kobject use count, so that accesses to the sysfs files do not
cause an access to freed kernel memory after an unmount.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

1 files changed, 18 insertions, 3 deletions

diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index 9c2592b1d5f..e4bee4bebbf 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -276,7 +276,15 @@ static struct attribute *gfs2_attrs[] = {
         NULL,
 };
 
+static void gfs2_sbd_release(struct kobject *kobj)
+{
+        struct gfs2_sbd *sdp = container_of(kobj, struct gfs2_sbd, sd_kobj);
+
+        kfree(sdp);
+}
+
 static struct kobj_type gfs2_ktype = {
+        .release = gfs2_sbd_release,
         .default_attrs = gfs2_attrs,
         .sysfs_ops     = &gfs2_attr_ops,
 };
@@ -583,6 +591,7 @@ int gfs2_sys_fs_add(struct gfs2_sbd *sdp)
         char ro[20];
         char spectator[20];
         char *envp[] = { ro, spectator, NULL };
+        int sysfs_frees_sdp = 0;
 
         sprintf(ro, "RDONLY=%d", (sb->s_flags & MS_RDONLY) ? 1 : 0);
         sprintf(spectator, "SPECTATOR=%d", sdp->sd_args.ar_spectator ? 1 : 0);
@@ -591,8 +600,10 @@ int gfs2_sys_fs_add(struct gfs2_sbd *sdp)
         error = kobject_init_and_add(&sdp->sd_kobj, &gfs2_ktype, NULL,
                                      "%s", sdp->sd_table_name);
         if (error)
-                goto fail;
+                goto fail_reg;
 
+        sysfs_frees_sdp = 1; /* Freeing sdp is now done by sysfs calling
+                                function gfs2_sbd_release. */
         error = sysfs_create_group(&sdp->sd_kobj, &tune_group);
         if (error)
                 goto fail_reg;
@@ -615,9 +626,13 @@ fail_lock_module:
 fail_tune:
         sysfs_remove_group(&sdp->sd_kobj, &tune_group);
 fail_reg:
-        kobject_put(&sdp->sd_kobj);
-fail:
+        free_percpu(sdp->sd_lkstats);
         fs_err(sdp, "error %d adding sysfs files", error);
+        if (sysfs_frees_sdp)
+                kobject_put(&sdp->sd_kobj);
+        else
+                kfree(sdp);
+        sb->s_fs_info = NULL;
         return error;
 }