Re: [PATCH] ocfs2: don't let the root inode outlive a failed mount

[Joseph Qi <joseph.qi@linux.alibaba.com>]

On 9/11/26 5:47 AM, Farhad Alemi wrote:
> ocfs2_init_global_system_inodes() installs osb->root_inode before the
> second ocfs2_iget() runs, and when that iget fails ocfs2_initialize_super()
> jumps to out_dlm_out, which sits below out_system_inodes, so
> ocfs2_release_system_inodes() never runs and the kfree(osb) that follows
> makes the stranded root inode reference unreachable.  ocfs2_fill_super()
> strands the same inode a second way: nothing drops the reference igrab()
> takes on osb->root_inode when an out_dismount path ahead of d_make_root()
> is taken, so the ocfs2_release_system_inodes() call inside
> ocfs2_dismount_volume() cannot free it and the root inode stays hashed on a
> superblock whose ocfs2_super has already been freed.  The reported KASAN
> slab-use-after-free write hits an ocfs2_inode_cache object that
> ocfs2_release_system_inodes() freed during teardown, so an ocfs2 inode
> reference that survives that call is a lifetime error on those same objects
> and not a bare leak.  Release the system inodes at that failing
> ocfs2_iget() and drop the igrab() reference on out_dismount, clearing inode
> right after d_make_root(), which consumes it on success and on failure
> alike, so it cannot be dropped twice.
> 
> Closes: https://lore.kernel.org/all/CA+0ovCjAKQMn7iF8BJR-3+G9_HBRnRFtJxjr-9P9GuKSxFj+3Q@mail.gmail.com/
> Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> ---
> --- a/fs/ocfs2/super.c
> +++ b/fs/ocfs2/super.c

Seems it is a corrupt patch?

> @@ -450,6 +450,7 @@ static int ocfs2_init_global_system_inodes(struct
> ocfs2_super *osb)
>  	if (IS_ERR(new)) {
>  		status = PTR_ERR(new);
>  		mlog_errno(status);
> +		ocfs2_release_system_inodes(osb);
>  		goto bail;
>  	}
>  	osb->sys_root_inode = new;
> @@ -1110,6 +1111,8 @@ static int ocfs2_fill_super(struct super_block
> *sb, struct fs_context *fc)
>  	}
> 
>  	root = d_make_root(inode);
> +	/* d_make_root() consumed our reference, on success and on failure. */
> +	inode = NULL;
>  	if (!root) {
>  		status = -ENOMEM;
>  		goto out_dismount;
> @@ -1163,6 +1166,7 @@ out_dismount:
>  	atomic_set(&osb->vol_state, VOLUME_DISABLED);
>  	wake_up(&osb->osb_mount_event);
>  	ocfs2_free_replay_slots(osb);

Please rebase on top of the latest linux-next.
The above 'ocfs2_free_replay_slots(osb)' is removed.

Thanks,
Joseph

> +	iput(inode);
>  	ocfs2_dismount_volume(sb, 1);
>  	goto out;