On Wed, Jun 28, 2023 at 04:30:52PM +0300, Dragos-Marian Panait wrote: > From: Bob Peterson <rpeterso@xxxxxxxxxx> > > [ Upstream commit 504a10d9e46bc37b23d0a1ae2f28973c8516e636 ] > > On corrupt gfs2 file systems the evict code can try to reference the > journal descriptor structure, jdesc, after it has been freed and set to > NULL. The sequence of events is: > > init_journal() > ... > fail_jindex: > gfs2_jindex_free(sdp); <------frees journals, sets jdesc = NULL > if (gfs2_holder_initialized(&ji_gh)) > gfs2_glock_dq_uninit(&ji_gh); > fail: > iput(sdp->sd_jindex); <--references jdesc in evict_linked_inode > evict() > gfs2_evict_inode() > evict_linked_inode() > ret = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks); > <------references the now freed/zeroed sd_jdesc pointer. > > The call to gfs2_trans_begin is done because the truncate_inode_pages > call can cause gfs2 events that require a transaction, such as removing > journaled data (jdata) blocks from the journal. > > This patch fixes the problem by adding a check for sdp->sd_jdesc to > function gfs2_evict_inode. In theory, this should only happen to corrupt > gfs2 file systems, when gfs2 detects the problem, reports it, then tries > to evict all the system inodes it has read in up to that point. > > Reported-by: Yang Lan <lanyang0908@xxxxxxxxx> > Signed-off-by: Bob Peterson <rpeterso@xxxxxxxxxx> > Signed-off-by: Andreas Gruenbacher <agruenba@xxxxxxxxxx> > [DP: adjusted context] > Signed-off-by: Dragos-Marian Panait <dragos.panait@xxxxxxxxxxxxx> > --- > fs/gfs2/super.c | 8 ++++++++ > 1 file changed, 8 insertions(+) All now queued up, thanks. greg k-h
