From 4df8fe0c50f6f616d21ca9809b391859073f5c54 Mon Sep 17 00:00:00 2001 From: Chunwei Chen <david.chen@osnexus.com> Date: Tue, 19 Jul 2016 12:02:33 -0700 Subject: [PATCH] Fix NULL pointer in zfs_preumount from 1d9b3bd When zfs_domount fails zsb will be freed, and its caller mount_nodev/get_sb_nodev will do deactivate_locked_super and calls into zfs_preumount. In order to make sure we don't touch any nonexistent stuff, we must make sure s_fs_info is NULL in the fail path so zfs_preumount can easily check that. Signed-off-by: Chunwei Chen <david.chen@osnexus.com> --- module/zfs/zfs_vfsops.c | 48 ++++++++++++++++++++++++----------------- 1 file changed, 28 insertions(+), 20 deletions(-) diff --git a/module/zfs/zfs_vfsops.c b/module/zfs/zfs_vfsops.c index b4a344ee30d5..96c7f8396533 100644 --- a/module/zfs/zfs_vfsops.c +++ b/module/zfs/zfs_vfsops.c @@ -1369,7 +1369,8 @@ zfs_domount(struct super_block *sb, zfs_mntopts_t *zmo, int silent) dmu_objset_set_user(zsb->z_os, zsb); mutex_exit(&zsb->z_os->os_user_ptr_lock); } else { - error = zfs_sb_setup(zsb, B_TRUE); + if ((error = zfs_sb_setup(zsb, B_TRUE))) + goto out; } /* Allocate a root inode for the filesystem. */ @@ -1395,6 +1396,11 @@ zfs_domount(struct super_block *sb, zfs_mntopts_t *zmo, int silent) if (error) { dmu_objset_disown(zsb->z_os, zsb); zfs_sb_free(zsb); + /* + * make sure we don't have dangling sb->s_fs_info which + * zfs_preumount will use. + */ + sb->s_fs_info = NULL; } return (error); @@ -1413,26 +1419,28 @@ zfs_preumount(struct super_block *sb) { zfs_sb_t *zsb = sb->s_fs_info; - if (zsb) + /* zsb is NULL when zfs_domount fails during mount */ + if (zsb) { zfsctl_destroy(sb->s_fs_info); - /* - * wait for iput_async before entering evict_inodes in - * generic_shutdown_super. The reason we must finish before - * evict_inodes is iput when lazytime is on or when zfs_purgedir calls - * zfs_zget would bump i_count from 0 to 1. This would race with the - * i_count check in evict_inodes, so it could destroy the inode while - * we are still using it. - * - * We wait for two pass, xattr dirs in the first pass may add xattr - * entries in zfs_purgedir, so we wait for second pass for them. Also, - * we don't use taskq_wait here is because it's a pool wise taskq, so - * other live filesystem can constantly do iput_async, there's no - * guarantee it will finish wait. - */ - taskq_wait_outstanding(dsl_pool_iput_taskq( - dmu_objset_pool(zsb->z_os)), 0); - taskq_wait_outstanding(dsl_pool_iput_taskq( - dmu_objset_pool(zsb->z_os)), 0); + /* + * wait for iput_async before entering evict_inodes in + * generic_shutdown_super. The reason we must finish before + * evict_inodes is iput when lazytime is on or when zfs_purgedir + * calls zfs_zget would bump i_count from 0 to 1. This would + * race with the i_count check in evict_inodes, so it could + * destroy the inode while we are still using it. + * + * We wait for two pass, xattr dirs in the first pass may add + * xattr entries in zfs_purgedir, so we wait for second pass + * for them. Also, we don't use taskq_wait here is because it's + * a pool wise taskq, so other live filesystem can constantly do + * iput_async, there's no guarantee it will finish wait. + */ + taskq_wait_outstanding(dsl_pool_iput_taskq( + dmu_objset_pool(zsb->z_os)), 0); + taskq_wait_outstanding(dsl_pool_iput_taskq( + dmu_objset_pool(zsb->z_os)), 0); + } } EXPORT_SYMBOL(zfs_preumount);