From: Sasha Levin <sashal@kernel.org>
To: cluster-devel.redhat.com
Subject: [Cluster-devel] [PATCH AUTOSEL 4.19 03/21] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
Date: Mon, 9 Nov 2020 22:55:23 -0500 [thread overview]
Message-ID: <20201110035541.424648-3-sashal@kernel.org> (raw)
In-Reply-To: <20201110035541.424648-1-sashal@kernel.org>
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the
call to return_all_reservations.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/rgrp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index c94c4ac1ae78b..1686a40099f21 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -739,9 +739,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
}
gfs2_free_clones(rgd);
+ return_all_reservations(rgd);
kfree(rgd->rd_bits);
rgd->rd_bits = NULL;
- return_all_reservations(rgd);
kmem_cache_free(gfs2_rgrpd_cachep, rgd);
}
}
--
2.27.0
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Bob Peterson <rpeterso@redhat.com>,
Andreas Gruenbacher <agruenba@redhat.com>,
Sasha Levin <sashal@kernel.org>,
cluster-devel@redhat.com
Subject: [PATCH AUTOSEL 4.19 03/21] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
Date: Mon, 9 Nov 2020 22:55:23 -0500 [thread overview]
Message-ID: <20201110035541.424648-3-sashal@kernel.org> (raw)
In-Reply-To: <20201110035541.424648-1-sashal@kernel.org>
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the
call to return_all_reservations.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/rgrp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index c94c4ac1ae78b..1686a40099f21 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -739,9 +739,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
}
gfs2_free_clones(rgd);
+ return_all_reservations(rgd);
kfree(rgd->rd_bits);
rgd->rd_bits = NULL;
- return_all_reservations(rgd);
kmem_cache_free(gfs2_rgrpd_cachep, rgd);
}
}
--
2.27.0
next prev parent reply other threads:[~2020-11-10 3:55 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-10 3:55 [PATCH AUTOSEL 4.19 01/21] usb: gadget: goku_udc: fix potential crashes in probe Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 02/21] ALSA: hda: Reinstate runtime_allow() for all hda controllers Sasha Levin
2020-11-10 3:55 ` Sasha Levin
2020-11-10 3:55 ` Sasha Levin [this message]
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 03/21] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free Sasha Levin
2020-11-10 3:55 ` [Cluster-devel] [PATCH AUTOSEL 4.19 04/21] gfs2: Add missing truncate_inode_pages_final for sd_aspace Sasha Levin
2020-11-10 3:55 ` Sasha Levin
2020-11-10 3:55 ` [Cluster-devel] [PATCH AUTOSEL 4.19 05/21] gfs2: check for live vs. read-only file system in gfs2_fitrim Sasha Levin
2020-11-10 3:55 ` Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 06/21] scsi: hpsa: Fix memory leak in hpsa_init_one() Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 07/21] drm/amdgpu: perform srbm soft reset always on SDMA resume Sasha Levin
2020-11-10 3:55 ` Sasha Levin
2020-11-10 3:55 ` Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 08/21] drm/amd/pm: perform SMC reset on suspend/hibernation Sasha Levin
2020-11-10 3:55 ` Sasha Levin
2020-11-10 3:55 ` Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 09/21] drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running Sasha Levin
2020-11-10 3:55 ` Sasha Levin
2020-11-10 3:55 ` Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 10/21] mac80211: fix use of skb payload instead of header Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 11/21] mac80211: always wind down STA state Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 12/21] cfg80211: regulatory: Fix inconsistent format argument Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 13/21] scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 14/21] iommu/amd: Increase interrupt remapping table limit to 512 entries Sasha Levin
2020-11-10 3:55 ` Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 15/21] s390/smp: move rcu_cpu_starting() earlier Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 16/21] vfio: platform: fix reference leak in vfio_platform_open Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 17/21] net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 18/21] kprobes: Tell lockdep about kprobe nesting Sasha Levin
2020-11-10 6:44 ` Masami Hiramatsu
2020-11-14 22:58 ` Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 19/21] selftests: proc: fix warning: _GNU_SOURCE redefined Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 20/21] tpm_tis: Disable interrupts on ThinkPad T490s Sasha Levin
2020-11-10 3:55 ` [PATCH AUTOSEL 4.19 21/21] vt: Disable KD_FONT_OP_COPY Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201110035541.424648-3-sashal@kernel.org \
--to=sashal@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.