From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bob Peterson Date: Thu, 29 Oct 2020 09:52:00 -0500 Subject: [Cluster-devel] [GFS2 PATCH 1/4] gfs2: Free rd_bits later in gfs2_clear-rgrpd to fix use-after-free In-Reply-To: <20201029145203.451643-1-rpeterso@redhat.com> References: <20201029145203.451643-1-rpeterso@redhat.com> Message-ID: <20201029145203.451643-2-rpeterso@redhat.com> List-Id: To: cluster-devel.redhat.com MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling return_all_reservations, but return_all_reservations still dereferences rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the call to return_all_reservations. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index ee491bb9c1cc..eb1b29734b7f 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -719,9 +719,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) } gfs2_free_clones(rgd); + return_all_reservations(rgd); kfree(rgd->rd_bits); rgd->rd_bits = NULL; - return_all_reservations(rgd); kmem_cache_free(gfs2_rgrpd_cachep, rgd); } } -- 2.26.2