Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Feedback-ID: i787e41f1:Fastmail
Date:   Wed, 28 Jun 2023 20:31:40 +0200
From:   Greg KH <greg@kroah.com>
To:     Dragos-Marian Panait <dragos.panait@windriver.com>
Cc:     stable@vger.kernel.org, Yang Lan <lanyang0908@gmail.com>,
        Bob Peterson <rpeterso@redhat.com>,
        Andreas Gruenbacher <agruenba@redhat.com>,
        cluster-devel@redhat.com, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 5.4] gfs2: Don't deref jdesc in evict
Message-ID: <2023062832-snuggle-casino-7f9e@gregkh>
References: <20230628133052.1796173-1-dragos.panait@windriver.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230628133052.1796173-1-dragos.panait@windriver.com>
Precedence: bulk

On Wed, Jun 28, 2023 at 04:30:52PM +0300, Dragos-Marian Panait wrote:
> From: Bob Peterson <rpeterso@redhat.com>
> 
> [ Upstream commit 504a10d9e46bc37b23d0a1ae2f28973c8516e636 ]
> 
> On corrupt gfs2 file systems the evict code can try to reference the
> journal descriptor structure, jdesc, after it has been freed and set to
> NULL. The sequence of events is:
> 
> init_journal()
> ...
> fail_jindex:
>    gfs2_jindex_free(sdp); <------frees journals, sets jdesc = NULL
>       if (gfs2_holder_initialized(&ji_gh))
>          gfs2_glock_dq_uninit(&ji_gh);
> fail:
>    iput(sdp->sd_jindex); <--references jdesc in evict_linked_inode
>       evict()
>          gfs2_evict_inode()
>             evict_linked_inode()
>                ret = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
> <------references the now freed/zeroed sd_jdesc pointer.
> 
> The call to gfs2_trans_begin is done because the truncate_inode_pages
> call can cause gfs2 events that require a transaction, such as removing
> journaled data (jdata) blocks from the journal.
> 
> This patch fixes the problem by adding a check for sdp->sd_jdesc to
> function gfs2_evict_inode. In theory, this should only happen to corrupt
> gfs2 file systems, when gfs2 detects the problem, reports it, then tries
> to evict all the system inodes it has read in up to that point.
> 
> Reported-by: Yang Lan <lanyang0908@gmail.com>
> Signed-off-by: Bob Peterson <rpeterso@redhat.com>
> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
> [DP: adjusted context]
> Signed-off-by: Dragos-Marian Panait <dragos.panait@windriver.com>
> ---
>  fs/gfs2/super.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

All now queued up, thanks.

greg k-h