From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF6E1C43463 for ; Fri, 18 Sep 2020 03:04:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 64E0D206B7 for ; Fri, 18 Sep 2020 03:04:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1600398287; bh=6h79j8puL8SLvyo0lXEikZ6F+2drafI4FcFwqp8XkYI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=tP357Lriz6TVex6jmIe0YSCGTiD0TNhWmNba7CzSWm1NF66GM4tFvduwhw2ad5343 Qgwfe1mSIxZLl71RSm+M8lmEfYBe6aMPz+EL055P84quOoOqoBCS75b4PEooADw906 jt3jfp93yXfhS+uwcfOx/m/Pwz1Nq8FigiuOEonM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730607AbgIRDEp (ORCPT ); Thu, 17 Sep 2020 23:04:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:52352 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727364AbgIRCEm (ORCPT ); Thu, 17 Sep 2020 22:04:42 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1C55123741; Fri, 18 Sep 2020 02:04:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1600394681; bh=6h79j8puL8SLvyo0lXEikZ6F+2drafI4FcFwqp8XkYI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S2X2HGwOBK4ld9QFwqt4W6tjlM2L8hNmHnijgIu5cosUCGMTwSUeCo+brNAWbafUa zJ7Iyag7edODvgAWveOFDvKK8T+K+AH9yhdkHVmXjfkQPpALP5vuVQGNXpDyfGZuc6 UiY3Zt0pxMUcvNz9UKLcnPBH17wBxtPSJQStoTr4= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: "Darrick J. Wong" , Dave Chinner , Sasha Levin , xfs@oss.sgi.com Subject: [PATCH AUTOSEL 5.4 171/330] xfs: don't ever return a stale pointer from __xfs_dir3_free_read Date: Thu, 17 Sep 2020 21:58:31 -0400 Message-Id: <20200918020110.2063155-171-sashal@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200918020110.2063155-1-sashal@kernel.org> References: <20200918020110.2063155-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: "Darrick J. Wong" [ Upstream commit 1cb5deb5bc095c070c09a4540c45f9c9ba24be43 ] If we decide that a directory free block is corrupt, we must take care not to leak a buffer pointer to the caller. After xfs_trans_brelse returns, the buffer can be freed or reused, which means that we have to set *bpp back to NULL. Callers are supposed to notice the nonzero return value and not use the buffer pointer, but we should code more defensively, even if all current callers handle this situation correctly. Fixes: de14c5f541e7 ("xfs: verify free block header fields") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Sasha Levin --- fs/xfs/libxfs/xfs_dir2_node.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c index 705c4f5627582..99d5b2ed67f2e 100644 --- a/fs/xfs/libxfs/xfs_dir2_node.c +++ b/fs/xfs/libxfs/xfs_dir2_node.c @@ -210,6 +210,7 @@ __xfs_dir3_free_read( if (fa) { xfs_verifier_error(*bpp, -EFSCORRUPTED, fa); xfs_trans_brelse(tp, *bpp); + *bpp = NULL; return -EFSCORRUPTED; } -- 2.25.1