Commit 74b4dbb9 authored by Andreas Gruenbacher's avatar Andreas Gruenbacher
Browse files

gfs2: prevent NULL pointer dereference during unmount 



When flushing out outstanding glock work during an unmount, gfs2_log_flush()
can be called when sdp->sd_jdesc has already been deallocated and sdp->sd_jdesc
is NULL.  Commit 35264909 ("gfs2: Fix NULL pointer dereference in
gfs2_log_flush") added a check for that to gfs2_log_flush() itself, but it
missed the sdp->sd_jdesc dereference in gfs2_log_release().  Fix that.

Reported-by: default avatarkernel test robot <lkp@intel.com>
Reported-by: default avatarDan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202604071139.HNJiCaAi-lkp@intel.com/


Fixes: 35264909 ("gfs2: Fix NULL pointer dereference in gfs2_log_flush")
Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
parent 734f0b4b

fs/gfs2/log.c

+3 −2
Original line number Diff line number Diff line
@@ -467,7 +467,8 @@ void gfs2_log_release(struct gfs2_sbd *sdp, unsigned int blks) 
{

	atomic_add(blks, &sdp->sd_log_blks_free);

	trace_gfs2_log_blocks(sdp, blks);

	gfs2_assert_withdraw(sdp, atomic_read(&sdp->sd_log_blks_free) <=

	gfs2_assert_withdraw(sdp, !sdp->sd_jdesc ||

			atomic_read(&sdp->sd_log_blks_free) <=

			sdp->sd_jdesc->jd_blocks);

	if (atomic_read(&sdp->sd_log_blks_needed))

		wake_up(&sdp->sd_log_waitq);