aboutsummaryrefslogtreecommitdiffstats
path: root/fs/xfs/xfs_mount.c
diff options
context:
space:
mode:
authorLachlan McIlroy <lachlan@sgi.com>2008-10-30 01:53:25 -0400
committerLachlan McIlroy <lachlan@sgi.com>2008-10-30 01:53:25 -0400
commita357a1215602f79182abdde27aaddc7166dbd709 (patch)
tree21d082a0cd92181123acaef9e9c10e1051bbe9df /fs/xfs/xfs_mount.c
parent46039928c9abe466ed1bc0da20c2e596b1d41236 (diff)
[XFS] Fix use-after-free with log and quotas
Destroying the quota stuff on unmount can access the log - ie XFS_QM_DONE() ends up in xfs_dqunlock() which calls xfs_trans_unlocked_item() and then xfs_log_move_tail(). By this time the log has already been destroyed. Just move the cleanup of the quota code earlier in xfs_unmountfs() before the call to xfs_log_unmount(). Moving XFS_QM_DONE() up near XFS_QM_DQPURGEALL() seems like a good spot. SGI-PV: 987086 SGI-Modid: xfs-linux-melb:xfs-kern:32148a Signed-off-by: Lachlan McIlroy <lachlan@sgi.com> Signed-off-by: Christoph Hellwig <hch@infradead.org> Signed-off-by: Peter Leckie <pleckie@sgi.com>
Diffstat (limited to 'fs/xfs/xfs_mount.c')
-rw-r--r--fs/xfs/xfs_mount.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index a4503f5e9497..15f5dd22fbb2 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1245,6 +1245,9 @@ xfs_unmountfs(
1245 1245
1246 XFS_QM_DQPURGEALL(mp, XFS_QMOPT_QUOTALL | XFS_QMOPT_UMOUNTING); 1246 XFS_QM_DQPURGEALL(mp, XFS_QMOPT_QUOTALL | XFS_QMOPT_UMOUNTING);
1247 1247
1248 if (mp->m_quotainfo)
1249 XFS_QM_DONE(mp);
1250
1248 /* 1251 /*
1249 * Flush out the log synchronously so that we know for sure 1252 * Flush out the log synchronously so that we know for sure
1250 * that nothing is pinned. This is important because bflush() 1253 * that nothing is pinned. This is important because bflush()
@@ -1297,8 +1300,6 @@ xfs_unmountfs(
1297 xfs_errortag_clearall(mp, 0); 1300 xfs_errortag_clearall(mp, 0);
1298#endif 1301#endif
1299 xfs_free_perag(mp); 1302 xfs_free_perag(mp);
1300 if (mp->m_quotainfo)
1301 XFS_QM_DONE(mp);
1302} 1303}
1303 1304
1304STATIC void 1305STATIC void