GFS2: Fix use-after-free bug on umount (try #2)

This should solve the issue with the previous attempt at fixing this.

Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

2 files changed, 12 insertions, 9 deletions

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 4cae60f4a175..f91eebdde581 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1263,17 +1263,21 @@ static int gfs2_get_sb_meta(struct file_system_type *fs_type, int flags,
 static void gfs2_kill_sb(struct super_block *sb)
 {
         struct gfs2_sbd *sdp = sb->s_fs_info;
-        if (sdp) {
-                gfs2_meta_syncfs(sdp);
-                dput(sdp->sd_root_dir);
-                dput(sdp->sd_master_dir);
-                sdp->sd_root_dir = NULL;
-                sdp->sd_master_dir = NULL;
+
+        if (sdp == NULL) {
+                kill_block_super(sb);
+                return;
         }
+
+        gfs2_meta_syncfs(sdp);
+        dput(sdp->sd_root_dir);
+        dput(sdp->sd_master_dir);
+        sdp->sd_root_dir = NULL;
+        sdp->sd_master_dir = NULL;
         shrink_dcache_sb(sb);
         kill_block_super(sb);
-        if (sdp)
-                gfs2_delete_debugfs_file(sdp);
+        gfs2_delete_debugfs_file(sdp);
+        kfree(sdp);
 }
 
 struct file_system_type gfs2_fs_type = {
diff --git a/fs/gfs2/ops_super.c b/fs/gfs2/ops_super.c
index 08837a728635..777783deddcb 100644
--- a/fs/gfs2/ops_super.c
+++ b/fs/gfs2/ops_super.c
@@ -182,7 +182,6 @@ static void gfs2_put_super(struct super_block *sb)
 
         /*  At this point, we're through participating in the lockspace  */
         gfs2_sys_fs_del(sdp);
-        kfree(sdp);
 }
 
 /**