lkml.org 
[lkml]   [2018]   [Dec]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 46/51] hfs: do not free node before using
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit ce96a407adef126870b3f4a1b73529dd8aa80f49 ]

    hfs_bmap_free() frees the node via hfs_bnode_put(node). However, it
    then reads node->this when dumping error message on an error path, which
    may result in a use-after-free bug. This patch frees the node only when
    it is never again used.

    Link: http://lkml.kernel.org/r/1542963889-128825-1-git-send-email-bianpan2016@163.com
    Fixes: a1185ffa2fc ("HFS rewrite")
    Signed-off-by: Pan Bian <bianpan2016@163.com>
    Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
    Cc: Joe Perches <joe@perches.com>
    Cc: Ernesto A. Fernandez <ernesto.mnd.fernandez@gmail.com>
    Cc: Viacheslav Dubeyko <slava@dubeyko.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/hfs/btree.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
    index 37cdd955eceb..320f4372f172 100644
    --- a/fs/hfs/btree.c
    +++ b/fs/hfs/btree.c
    @@ -328,13 +328,14 @@ void hfs_bmap_free(struct hfs_bnode *node)

    nidx -= len * 8;
    i = node->next;
    - hfs_bnode_put(node);
    if (!i) {
    /* panic */;
    pr_crit("unable to free bnode %u. bmap not found!\n",
    node->this);
    + hfs_bnode_put(node);
    return;
    }
    + hfs_bnode_put(node);
    node = hfs_bnode_find(tree, i);
    if (IS_ERR(node))
    return;
    --
    2.19.1


    \
     
     \ /
      Last update: 2018-12-14 13:24    [W:3.029 / U:1.732 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site