[Fwd: [PATCH] reiser4: fix a use after free bug in reiser4_parse_options]

[Fwd: [PATCH] reiser4: fix a use after free bug in reiser4_parse_options]

[Laurent Riffard]

[-- Attachment #1: Type: text/plain, Size: 1113 bytes --]

Hello,

I posted this patch last week and nobody replied.

So, if there is no objections, Andrew please apply.

Thank you.

-------- Message original --------
Sujet: [PATCH] reiser4: fix a use after free bug in
reiser4_parse_options
Date: Thu, 18 Nov 2004 00:09:36 +0100
De: Laurent Riffard <laurent.riffard@free.fr>
Pour: reiserfs-list@namesys.com

This patch fix a "use after kfree" bug in reiser4_parse_options.

Signed-off-by: Laurent Riffard <laurent.riffard@free.fr>
---

diff -u linux-2.6-orig/fs/reiser4/vfs_ops.c
linux-2.6/fs/reiser4/vfs_ops.c
--- linux-2.6-orig/fs/reiser4/vfs_ops.c	2004-11-17
23:43:22.186242952 +0100
+++ linux-2.6/fs/reiser4/vfs_ops.c	2004-11-17 23:39:15.935678728 +0100
@@ -1060,8 +1060,6 @@
  	});
  #endif

-	kfree(opts);
-
  	sbinfo->tmgr.atom_max_size = txnmgr_get_max_atom_size(s);
  	sbinfo->tmgr.atom_max_age = REISER4_ATOM_MAX_AGE / HZ;
  	sbinfo->tmgr.atom_max_flushers = ATOM_MAX_FLUSHERS;
@@ -1089,6 +1087,9 @@
  	sbinfo->ra_params.flags = 0;

  	result = parse_options(opt_string, opts, p - opts);
+
+	kfree(opts);
+
  	if (result != 0)
  		return result;


-- 
laurent


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]

Re: [Fwd: [PATCH] reiser4: fix a use after free bug in reiser4_parse_options]

[Andrew Morton]

Laurent Riffard <laurent.riffard@free.fr> wrote:
>
> This patch fix a "use after kfree" bug in reiser4_parse_options.

I'll add that to -mm.  In future, please don't allow your email client to
wordwrap patches.  Thanks.

Re: [Fwd: [PATCH] reiser4: fix a use after free bug in reiser4_parse_options]

[Hans Reiser]

Apologies, things have been hectic at Namesys.

Vs, please review tomorrow and comment.

Hans

Laurent Riffard wrote:

> Hello,
>
> I posted this patch last week and nobody replied.
>
> So, if there is no objections, Andrew please apply.
>
> Thank you.
>
> -------- Message original --------
> Sujet: [PATCH] reiser4: fix a use after free bug in
> reiser4_parse_options
> Date: Thu, 18 Nov 2004 00:09:36 +0100
> De: Laurent Riffard <laurent.riffard@free.fr>
> Pour: reiserfs-list@namesys.com
>
> This patch fix a "use after kfree" bug in reiser4_parse_options.
>
> Signed-off-by: Laurent Riffard <laurent.riffard@free.fr>
> ---
>
> diff -u linux-2.6-orig/fs/reiser4/vfs_ops.c
> linux-2.6/fs/reiser4/vfs_ops.c
> --- linux-2.6-orig/fs/reiser4/vfs_ops.c    2004-11-17
> 23:43:22.186242952 +0100
> +++ linux-2.6/fs/reiser4/vfs_ops.c    2004-11-17 23:39:15.935678728 +0100
> @@ -1060,8 +1060,6 @@
>      });
>  #endif
>
> -    kfree(opts);
> -
>      sbinfo->tmgr.atom_max_size = txnmgr_get_max_atom_size(s);
>      sbinfo->tmgr.atom_max_age = REISER4_ATOM_MAX_AGE / HZ;
>      sbinfo->tmgr.atom_max_flushers = ATOM_MAX_FLUSHERS;
> @@ -1089,6 +1087,9 @@
>      sbinfo->ra_params.flags = 0;
>
>      result = parse_options(opt_string, opts, p - opts);
> +
> +    kfree(opts);
> +
>      if (result != 0)
>          return result;
>
>

Re: [Fwd: [PATCH] reiser4: fix a use after free bug in reiser4_parse_options]

[Vladimir Saveliev]

Hello

On Tue, 2004-11-23 at 08:21, Hans Reiser wrote:
> Apologies, things have been hectic at Namesys.

Thanks, Laurent
Your patch is merged in reiser4 bk repository.

> 
> Vs, please review tomorrow and comment.
> 
> Hans
> 
> Laurent Riffard wrote:
> 
> > Hello,
> >
> > I posted this patch last week and nobody replied.
> >
> > So, if there is no objections, Andrew please apply.
> >
> > Thank you.
> >
> > -------- Message original --------
> > Sujet: [PATCH] reiser4: fix a use after free bug in
> > reiser4_parse_options
> > Date: Thu, 18 Nov 2004 00:09:36 +0100
> > De: Laurent Riffard <laurent.riffard@free.fr>
> > Pour: reiserfs-list@namesys.com
> >
> > This patch fix a "use after kfree" bug in reiser4_parse_options.
> >
> > Signed-off-by: Laurent Riffard <laurent.riffard@free.fr>
> > ---
> >
> > diff -u linux-2.6-orig/fs/reiser4/vfs_ops.c
> > linux-2.6/fs/reiser4/vfs_ops.c
> > --- linux-2.6-orig/fs/reiser4/vfs_ops.c    2004-11-17
> > 23:43:22.186242952 +0100
> > +++ linux-2.6/fs/reiser4/vfs_ops.c    2004-11-17 23:39:15.935678728 +0100
> > @@ -1060,8 +1060,6 @@
> >      });
> >  #endif
> >
> > -    kfree(opts);
> > -
> >      sbinfo->tmgr.atom_max_size = txnmgr_get_max_atom_size(s);
> >      sbinfo->tmgr.atom_max_age = REISER4_ATOM_MAX_AGE / HZ;
> >      sbinfo->tmgr.atom_max_flushers = ATOM_MAX_FLUSHERS;
> > @@ -1089,6 +1087,9 @@
> >      sbinfo->ra_params.flags = 0;
> >
> >      result = parse_options(opt_string, opts, p - opts);
> > +
> > +    kfree(opts);
> > +
> >      if (result != 0)
> >          return result;
> >
> >
> 
> 

Re: [Fwd: [PATCH] reiser4: fix a use after free bug in reiser4_parse_options]

[Laurent Riffard]

[-- Attachment #1: Type: text/plain, Size: 431 bytes --]


Vladimir Saveliev a écrit :
> Hello
> 
> On Tue, 2004-11-23 at 08:21, Hans Reiser wrote:
> 
>>Apologies, things have been hectic at Namesys.
> 
> 
> Thanks, Laurent
> Your patch is merged in reiser4 bk repository.

Thank you for your attention. I wondered to whom a patch should be 
sent.

Andrew: sorry for the wrapped line, I carefully checked the 
tab/space conversions and I missed this line.

-- 
laurent

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]