[PATCH 1/2] gfs2: release the statfs glock when gfs2_clear_beyond_eof() fails

[Joseph Qi]

gfs2_file_buffered_write() acquires the master statfs glock before
writing to the rindex and releases it once the write is done.  The only
error path in between used to be the failure of that acquisition, which
gfs2_glock_nq_init() unwinds by itself, so the cleanup code at the end of
the function never had to deal with a held statfs glock.

Commit 4982e58669b1 ("gfs2: page poisoning fix") added a call to
gfs2_clear_beyond_eof() right after the acquisition and made it jump to
out_unlock on failure.  That path only drops the inode glock and then
frees statfs_gh, so a failed write to the rindex leaves the master
statfs glock held exclusively and frees a holder that is still linked
into the glock's holder list.  The GL_NOCACHE demote is requested by
__gfs2_glock_dq(), which is never reached, so the glock stays locked for
the rest of the mount, and the glock and pid references taken by
__gfs2_holder_init() leak as well.  Walking the stale list entry later
on, for instance from do_promote() or from a demote callback, is a
use-after-free.

gfs2_clear_beyond_eof() zeroes the space beyond eof, which for the
rindex ends up in adjust_fs_space(), so the call cannot be moved out
from under the statfs glock.  Release the holder in the error path
instead, guarded by gfs2_holder_initialized() so that the paths which
never acquired it and the one which already released it are unaffected.

Fixes: 4982e58669b1 ("gfs2: page poisoning fix")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>
---
 fs/gfs2/file.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index 1efd0679badd9..2452d3ecf09c7 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -1087,6 +1087,8 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb,
 		goto retry;
 	}
 out_unlock:
+	if (inode == sdp->sd_rindex && gfs2_holder_initialized(statfs_gh))
+		gfs2_glock_dq_uninit(statfs_gh);
 	if (gfs2_holder_queued(gh))
 		gfs2_glock_dq(gh);
 out_uninit:
-- 
2.39.3