From: Eric Sandeen <sandeen@redhat.com>
To: Christoph Hellwig <hch@infradead.org>,
Eric Sandeen <sandeen@sandeen.net>
Cc: xfs-oss <xfs@oss.sgi.com>
Subject: Re: [PATCH] xfsprogs: fix use after free in inode_item_done()
Date: Wed, 05 Mar 2014 16:40:55 -0600 [thread overview]
Message-ID: <5317A7F7.4060404@redhat.com> (raw)
In-Reply-To: <20140305223612.GA25639@infradead.org>
On 3/5/14, 4:36 PM, Christoph Hellwig wrote:
> On Wed, Mar 05, 2014 at 11:19:19AM -0600, Eric Sandeen wrote:
>> Yeah, that does seem better! Thanks for spotting that.
>>
>> The difference when calling inode_item_unlock is a bit more zeroing-out:
>>
>> ip->i_transp = NULL;
>>
>> iip->ili_flags = 0;
>>
>> I'm not sure of the implications of that offhand, TBH.
>>
>> Dave, hold off on my commit I guess ;)
>
> i_itransp nulling is obviously harmless as we are freeing the inode
> right after.
Not in all cases, right?
static void
inode_item_unlock(
xfs_inode_log_item_t *iip)
{
xfs_inode_t *ip = iip->ili_inode;
/* Clear the transaction pointer in the inode. */
ip->i_transp = NULL;
iip->ili_flags = 0;
if (!iip->ili_lock_flags)
libxfs_iput(ip, 0);
else
iip->ili_lock_flags = 0; // <-- not here.
}
> ili_flags is always 0 in libxfs and we might as well just remove it.
>
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
prev parent reply other threads:[~2014-03-05 22:41 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-03 20:41 [PATCH] xfsprogs: fix use after free in inode_item_done() Eric Sandeen
2014-03-03 22:36 ` Dave Chinner
2014-03-03 22:48 ` Eric Sandeen
2014-03-03 22:55 ` Dave Chinner
2014-03-04 13:04 ` Roger Willcocks
2014-03-03 22:58 ` [PATCH V2] " Eric Sandeen
2014-03-03 23:09 ` Dave Chinner
2014-03-05 17:02 ` [PATCH] " Christoph Hellwig
2014-03-05 17:19 ` Eric Sandeen
[not found] ` <20140305223612.GA25639@infradead.org>
2014-03-05 22:40 ` Eric Sandeen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5317A7F7.4060404@redhat.com \
--to=sandeen@redhat.com \
--cc=hch@infradead.org \
--cc=sandeen@sandeen.net \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.