• Bob Peterson's avatar
    gfs2: Fix use-after-free in gfs2_logd after withdraw · d22f69a0
    Bob Peterson authored
    When the gfs2_logd daemon withdrew, the withdraw sequence called
    into make_fs_ro() to make the file system read-only. That caused the
    journal descriptors to be freed. However, those journal descriptors
    were used by gfs2_logd's call to gfs2_ail_flush_reqd(). This caused
    a use-after free and NULL pointer dereference.
    
    This patch changes function gfs2_logd() so that it stops all logd
    work until the thread is told to stop. Once a withdraw is done,
    it only does an interruptible sleep.
    Signed-off-by: default avatarBob Peterson <rpeterso@redhat.com>
    Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
    d22f69a0
log.c 32.4 KB