[PATCH] gfs2: Add rcu_barrier() before free_sbd() in fill_super() error path

Commit f9c9ec2c319f ("gfs2: fix use-after-free in gfs2_qd_dealloc")
added an rcu_barrier() before free_sbd() in gfs2_put_super() so that
RCU callbacks which dereference the superblock through qd->qd_sbd have
run before the superblock is freed.  The error path of fill_super()
frees the superblock through the same free_sbd() call, but without
waiting for those callbacks.

Quota objects can be alive while a mount is failing:
gfs2_make_fs_rw() runs gfs2_quota_init(), which creates quota data
objects for the entries of the quota change file; if reading the file
fails part way, gfs2_quota_init() itself calls gfs2_quota_cleanup(),
and a withdrawn filesystem makes gfs2_make_fs_rw() call it as well.
Both dispose of quota objects via gfs2_qd_dispose(), which ends with
call_rcu(&qd->qd_rcu, gfs2_qd_dealloc); gfs2_qd_dealloc() then
decrements sdp->sd_quota_count and may wake sdp->sd_kill_wait after
free_sbd() has already released the superblock.

Mirror the unmount path and wait for pending RCU callbacks before
free_sbd() in the fill_super() error path.

This issue was found by an in-house static analysis tool.

Fixes: a475c5dd16e5 ("gfs2: Free quota data objects synchronously")
Cc: [email protected]
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <[email protected]>
---
 fs/gfs2/ops_fstype.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 718e0da7dfce..7425720697ef 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1314,6 +1314,7 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
 fail_iput:
 	iput(sdp->sd_inode);
 fail_free:
+	rcu_barrier();
 	free_sbd(sdp);
 	return error;
 }