From: Sasha Levin <sashal@kernel.org>
To: cluster-devel.redhat.com
Subject: [Cluster-devel] [PATCH AUTOSEL 5.9 14/55] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
Date: Mon, 9 Nov 2020 22:52:37 -0500 [thread overview]
Message-ID: <20201110035318.423757-14-sashal@kernel.org> (raw)
In-Reply-To: <20201110035318.423757-1-sashal@kernel.org>
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the
call to return_all_reservations.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/rgrp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 1bba5a9d45fa3..1d65db1b3914a 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -719,9 +719,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
}
gfs2_free_clones(rgd);
+ return_all_reservations(rgd);
kfree(rgd->rd_bits);
rgd->rd_bits = NULL;
- return_all_reservations(rgd);
kmem_cache_free(gfs2_rgrpd_cachep, rgd);
}
}
--
2.27.0
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Bob Peterson <rpeterso@redhat.com>,
Andreas Gruenbacher <agruenba@redhat.com>,
Sasha Levin <sashal@kernel.org>,
cluster-devel@redhat.com
Subject: [PATCH AUTOSEL 5.9 14/55] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
Date: Mon, 9 Nov 2020 22:52:37 -0500 [thread overview]
Message-ID: <20201110035318.423757-14-sashal@kernel.org> (raw)
In-Reply-To: <20201110035318.423757-1-sashal@kernel.org>
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the
call to return_all_reservations.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/rgrp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 1bba5a9d45fa3..1d65db1b3914a 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -719,9 +719,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
}
gfs2_free_clones(rgd);
+ return_all_reservations(rgd);
kfree(rgd->rd_bits);
rgd->rd_bits = NULL;
- return_all_reservations(rgd);
kmem_cache_free(gfs2_rgrpd_cachep, rgd);
}
}
--
2.27.0
next prev parent reply other threads:[~2020-11-10 3:52 UTC|newest]
Thread overview: 97+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-10 3:52 [PATCH AUTOSEL 5.9 01/55] ASoC: mediatek: mt8183-da7219: fix DAPM paths for rt1015 Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 02/55] ASoC: qcom: sdm845: set driver name correctly Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 03/55] ASoC: cs42l51: manage mclk shutdown delay Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 04/55] ASoC: SOF: loader: handle all SOF_IPC_EXT types Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 05/55] usb: dwc3: pci: add support for the Intel Alder Lake-S Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 06/55] opp: Reduce the size of critical section in _opp_table_kref_release() Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 07/55] usb: gadget: goku_udc: fix potential crashes in probe Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 08/55] usb: raw-gadget: fix memory leak in gadget_setup Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 09/55] selftests/ftrace: check for do_sys_openat2 in user-memory test Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 10/55] selftests: pidfd: fix compilation errors due to wait.h Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 11/55] ALSA: hda: Separate runtime and system suspend Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 12/55] ALSA: hda: Reinstate runtime_allow() for all hda controllers Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 13/55] x86/boot/compressed/64: Introduce sev_status Sasha Levin
2020-11-10 3:52 ` Sasha Levin [this message]
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 14/55] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free Sasha Levin
2020-11-10 3:52 ` [Cluster-devel] [PATCH AUTOSEL 5.9 15/55] gfs2: Add missing truncate_inode_pages_final for sd_aspace Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [Cluster-devel] [PATCH AUTOSEL 5.9 16/55] gfs2: check for live vs. read-only file system in gfs2_fitrim Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 17/55] scsi: hpsa: Fix memory leak in hpsa_init_one() Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 18/55] drm/amdgpu: perform srbm soft reset always on SDMA resume Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 19/55] drm/amd/pm: correct the baco reset sequence for CI ASICs Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 20/55] drm/amd/pm: perform SMC reset on suspend/hibernation Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 21/55] drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 22/55] mac80211: fix use of skb payload instead of header Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 23/55] cfg80211: initialize wdev data earlier Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 24/55] mac80211: always wind down STA state Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 25/55] cfg80211: regulatory: Fix inconsistent format argument Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk Sasha Levin
2020-11-10 12:29 ` Jason A. Donenfeld
2020-11-10 17:21 ` Greg KH
2020-11-13 22:40 ` Jason A. Donenfeld
2020-11-13 22:49 ` [PATCH 4.19] netfilter: use actual socket sk rather than skb sk when routing harder Jason A. Donenfeld
2020-11-14 0:06 ` Greg KH
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 27/55] tracing: Fix the checking of stackidx in __ftrace_trace_stack Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 28/55] Revert "nvme-pci: remove last_sq_tail" Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 29/55] ARC: [plat-hsdk] Remap CCMs super early in asm boot trampoline Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 30/55] scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 31/55] scsi: mpt3sas: Fix timeouts observed while reenabling IRQ Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 32/55] nvme: introduce nvme_sync_io_queues Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 33/55] nvme-rdma: avoid race between time out and tear down Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 34/55] nvme-tcp: " Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 35/55] nvme-rdma: avoid repeated request completion Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 36/55] nvme-tcp: " Sasha Levin
2020-11-10 3:52 ` Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 37/55] iommu/amd: Increase interrupt remapping table limit to 512 entries Sasha Levin
2020-11-10 3:53 ` Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 38/55] s390/smp: move rcu_cpu_starting() earlier Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 39/55] vfio: platform: fix reference leak in vfio_platform_open Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 40/55] vfio/pci: Bypass IGD init in case of -ENODEV Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 41/55] i2c: mediatek: move dma reset before i2c reset Sasha Levin
2020-11-10 3:53 ` Sasha Levin
2020-11-10 3:53 ` Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 42/55] net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 43/55] amd/amdgpu: Disable VCN DPG mode for Picasso Sasha Levin
2020-11-10 3:53 ` Sasha Levin
2020-11-10 3:53 ` Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 44/55] kprobes: Tell lockdep about kprobe nesting Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 45/55] iomap: clean up writeback state logic on writepage error Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 46/55] selftests: proc: fix warning: _GNU_SOURCE redefined Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 47/55] arm64: kexec_file: try more regions if loading segments fails Sasha Levin
2020-11-10 3:53 ` Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 48/55] riscv: Set text_offset correctly for M-Mode Sasha Levin
2020-11-10 3:53 ` Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 49/55] i2c: sh_mobile: implement atomic transfers Sasha Levin
2020-11-10 3:53 ` Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 50/55] i2c: designware: call i2c_dw_read_clear_intrbits_slave() once Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 51/55] i2c: designware: slave should do WRITE_REQUESTED before WRITE_RECEIVED Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 52/55] tpm_tis: Disable interrupts on ThinkPad T490s Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 53/55] seq_file: add seq_read_iter Sasha Levin
2020-11-10 6:30 ` Greg Kroah-Hartman
2020-11-10 9:05 ` Christoph Hellwig
2020-11-10 17:35 ` Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 54/55] vt: Disable KD_FONT_OP_COPY Sasha Levin
2020-11-10 3:53 ` [PATCH AUTOSEL 5.9 55/55] fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201110035318.423757-14-sashal@kernel.org \
--to=sashal@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.