From: Sasha Levin <sashal@kernel.org>
To: cluster-devel.redhat.com
Subject: [Cluster-devel] [PATCH AUTOSEL 5.4 10/42] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
Date: Mon, 9 Nov 2020 22:54:08 -0500 [thread overview]
Message-ID: <20201110035440.424258-10-sashal@kernel.org> (raw)
In-Reply-To: <20201110035440.424258-1-sashal@kernel.org>
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the
call to return_all_reservations.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/rgrp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 2466bb44a23c5..e23735084ad17 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -736,9 +736,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
}
gfs2_free_clones(rgd);
+ return_all_reservations(rgd);
kfree(rgd->rd_bits);
rgd->rd_bits = NULL;
- return_all_reservations(rgd);
kmem_cache_free(gfs2_rgrpd_cachep, rgd);
}
}
--
2.27.0
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Bob Peterson <rpeterso@redhat.com>,
Andreas Gruenbacher <agruenba@redhat.com>,
Sasha Levin <sashal@kernel.org>,
cluster-devel@redhat.com
Subject: [PATCH AUTOSEL 5.4 10/42] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
Date: Mon, 9 Nov 2020 22:54:08 -0500 [thread overview]
Message-ID: <20201110035440.424258-10-sashal@kernel.org> (raw)
In-Reply-To: <20201110035440.424258-1-sashal@kernel.org>
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the
call to return_all_reservations.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/rgrp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 2466bb44a23c5..e23735084ad17 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -736,9 +736,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
}
gfs2_free_clones(rgd);
+ return_all_reservations(rgd);
kfree(rgd->rd_bits);
rgd->rd_bits = NULL;
- return_all_reservations(rgd);
kmem_cache_free(gfs2_rgrpd_cachep, rgd);
}
}
--
2.27.0
next prev parent reply other threads:[~2020-11-10 3:54 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-10 3:53 [PATCH AUTOSEL 5.4 01/42] ASoC: qcom: sdm845: set driver name correctly Sasha Levin
2020-11-10 3:53 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 02/42] ASoC: cs42l51: manage mclk shutdown delay Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 03/42] usb: dwc3: pci: add support for the Intel Alder Lake-S Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 04/42] opp: Reduce the size of critical section in _opp_table_kref_release() Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 05/42] usb: gadget: goku_udc: fix potential crashes in probe Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 06/42] selftests/ftrace: check for do_sys_openat2 in user-memory test Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 07/42] selftests: pidfd: fix compilation errors due to wait.h Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 08/42] ALSA: hda: Separate runtime and system suspend Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 09/42] ALSA: hda: Reinstate runtime_allow() for all hda controllers Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` Sasha Levin [this message]
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 10/42] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free Sasha Levin
2020-11-10 3:54 ` [Cluster-devel] [PATCH AUTOSEL 5.4 11/42] gfs2: Add missing truncate_inode_pages_final for sd_aspace Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [Cluster-devel] [PATCH AUTOSEL 5.4 12/42] gfs2: check for live vs. read-only file system in gfs2_fitrim Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 13/42] scsi: hpsa: Fix memory leak in hpsa_init_one() Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 14/42] drm/amdgpu: perform srbm soft reset always on SDMA resume Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 15/42] drm/amd/pm: perform SMC reset on suspend/hibernation Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 16/42] drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 17/42] mac80211: fix use of skb payload instead of header Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 18/42] cfg80211: initialize wdev data earlier Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 19/42] mac80211: always wind down STA state Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 20/42] cfg80211: regulatory: Fix inconsistent format argument Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 21/42] tracing: Fix the checking of stackidx in __ftrace_trace_stack Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 22/42] scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 23/42] scsi: mpt3sas: Fix timeouts observed while reenabling IRQ Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 24/42] nvme: introduce nvme_sync_io_queues Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 25/42] nvme-rdma: avoid race between time out and tear down Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 26/42] nvme-tcp: " Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 27/42] nvme-rdma: avoid repeated request completion Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 28/42] nvme-tcp: " Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 29/42] iommu/amd: Increase interrupt remapping table limit to 512 entries Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 30/42] s390/smp: move rcu_cpu_starting() earlier Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 31/42] vfio: platform: fix reference leak in vfio_platform_open Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 32/42] vfio/pci: Bypass IGD init in case of -ENODEV Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 33/42] i2c: mediatek: move dma reset before i2c reset Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 34/42] net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 35/42] amd/amdgpu: Disable VCN DPG mode for Picasso Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 36/42] kprobes: Tell lockdep about kprobe nesting Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 37/42] selftests: proc: fix warning: _GNU_SOURCE redefined Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 38/42] riscv: Set text_offset correctly for M-Mode Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 39/42] i2c: sh_mobile: implement atomic transfers Sasha Levin
2020-11-10 3:54 ` Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 40/42] tpm_tis: Disable interrupts on ThinkPad T490s Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 41/42] vt: Disable KD_FONT_OP_COPY Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 42/42] fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201110035440.424258-10-sashal@kernel.org \
--to=sashal@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.