lkml.org 
[lkml]   [2020]   [Nov]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 089/255] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
    Date
    From: Bob Peterson <rpeterso@redhat.com>

    [ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]

    Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
    return_all_reservations, but return_all_reservations still dereferences
    rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the
    call to return_all_reservations.

    Signed-off-by: Bob Peterson <rpeterso@redhat.com>
    Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/gfs2/rgrp.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
    index 1bba5a9d45fa3..1d65db1b3914a 100644
    --- a/fs/gfs2/rgrp.c
    +++ b/fs/gfs2/rgrp.c
    @@ -719,9 +719,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
    }

    gfs2_free_clones(rgd);
    + return_all_reservations(rgd);
    kfree(rgd->rd_bits);
    rgd->rd_bits = NULL;
    - return_all_reservations(rgd);
    kmem_cache_free(gfs2_rgrpd_cachep, rgd);
    }
    }
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-11-17 14:40    [W:4.932 / U:0.268 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site