gfs2_file_buffered_write() acquires the master statfs glock before writing to the rindex and releases it once the write is done. The only error path in between used to be the failure of that acquisition, which gfs2_glock_nq_init() unwinds by itself, so the cleanup code at the end of the function never had to deal with a held statfs glock. Commit 4982e58669b1 ("gfs2: page poisoning fix") added a call to gfs2_clear_beyond_eof() right after the acquisition and made it jump to out_unlock on failure. That path only drops the inode glock and then frees statfs_gh, so a failed write to the rindex leaves the master statfs glock held exclusively and frees a holder that is still linked into the glock's holder list. The GL_NOCACHE demote is requested by __gfs2_glock_dq(), which is never reached, so the glock stays locked for the rest of the mount, and the glock and pid references taken by __gfs2_holder_init() leak as well. Walking the stale list entry later on, for instance from do_promote() or from a demote callback, is a use-after-free. gfs2_clear_beyond_eof() zeroes the space beyond eof, which for the rindex ends up in adjust_fs_space(), so the call cannot be moved out from under the statfs glock. Release the holder in the error path instead, guarded by gfs2_holder_initialized() so that the paths which never acquired it and the one which already released it are unaffected. Fixes: 4982e58669b1 ("gfs2: page poisoning fix") Cc: stable@vger.kernel.org Signed-off-by: Joseph Qi --- fs/gfs2/file.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c index 1efd0679badd9..2452d3ecf09c7 100644 --- a/fs/gfs2/file.c +++ b/fs/gfs2/file.c @@ -1087,6 +1087,8 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb, goto retry; } out_unlock: + if (inode == sdp->sd_rindex && gfs2_holder_initialized(statfs_gh)) + gfs2_glock_dq_uninit(statfs_gh); if (gfs2_holder_queued(gh)) gfs2_glock_dq(gh); out_uninit: -- 2.39.3