aboutsummaryrefslogtreecommitdiffstats
path: root/fs/gfs2/super.c
diff options
context:
space:
mode:
authorSteven Whitehouse <swhiteho@redhat.com>2008-11-27 03:27:28 -0500
committerSteven Whitehouse <swhiteho@redhat.com>2009-01-05 02:39:14 -0500
commit3af165ac4d099385b12e3e75a9ee3ffd02da33e0 (patch)
treeb90552f6ac8db316c05d5f3246366cfa09cc7473 /fs/gfs2/super.c
parent2e204703a1161e9bae38ba0d3d0df04a679e6f4f (diff)
GFS2: Fix use-after-free bug on umount
There was a use-after-free with the GFS2 super block during umount. This patch moves almost all of the umount code from ->put_super into ->kill_sb, the only bit that cannot be moved being the glock hash clearing which has to remain as ->put_super due to umount ordering requirements. As a result its now obvious that the kfree is the final operation, whereas before it was hidden in ->put_super. Also gfs2_jindex_free is then only referenced from a single file so thats moved and marked static too. Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
Diffstat (limited to 'fs/gfs2/super.c')
-rw-r--r--fs/gfs2/super.c34
1 files changed, 0 insertions, 34 deletions
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 141b781f2fcc..f14658b20204 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -33,40 +33,6 @@
33#include "trans.h" 33#include "trans.h"
34#include "util.h" 34#include "util.h"
35 35
36/**
37 * gfs2_jindex_free - Clear all the journal index information
38 * @sdp: The GFS2 superblock
39 *
40 */
41
42void gfs2_jindex_free(struct gfs2_sbd *sdp)
43{
44 struct list_head list, *head;
45 struct gfs2_jdesc *jd;
46 struct gfs2_journal_extent *jext;
47
48 spin_lock(&sdp->sd_jindex_spin);
49 list_add(&list, &sdp->sd_jindex_list);
50 list_del_init(&sdp->sd_jindex_list);
51 sdp->sd_journals = 0;
52 spin_unlock(&sdp->sd_jindex_spin);
53
54 while (!list_empty(&list)) {
55 jd = list_entry(list.next, struct gfs2_jdesc, jd_list);
56 head = &jd->extent_list;
57 while (!list_empty(head)) {
58 jext = list_entry(head->next,
59 struct gfs2_journal_extent,
60 extent_list);
61 list_del(&jext->extent_list);
62 kfree(jext);
63 }
64 list_del(&jd->jd_list);
65 iput(jd->jd_inode);
66 kfree(jd);
67 }
68}
69
70static struct gfs2_jdesc *jdesc_find_i(struct list_head *head, unsigned int jid) 36static struct gfs2_jdesc *jdesc_find_i(struct list_head *head, unsigned int jid)
71{ 37{
72 struct gfs2_jdesc *jd; 38 struct gfs2_jdesc *jd;