From: Dave Chinner <david@fromorbit.com>
To: xfs@oss.sgi.com
Subject: [PATCH 3/5] xfs: Don't reference the EFI after it is freed
Date: Fri, 17 May 2013 11:10:27 +1000 [thread overview]
Message-ID: <1368753029-9977-4-git-send-email-david@fromorbit.com> (raw)
In-Reply-To: <1368753029-9977-1-git-send-email-david@fromorbit.com>
From: Dave Chinner <dchinner@redhat.com>
Checking the EFI for whether it is being released from recovery
after we've already released the known active reference is a mistake
worthy of a brown paper bag. Fix the (now) obvious use after free
that it can cause.
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
---
fs/xfs/xfs_extfree_item.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index c0f3750..452920a 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -305,11 +305,12 @@ xfs_efi_release(xfs_efi_log_item_t *efip,
{
ASSERT(atomic_read(&efip->efi_next_extent) >= nextents);
if (atomic_sub_and_test(nextents, &efip->efi_next_extent)) {
- __xfs_efi_release(efip);
-
/* recovery needs us to drop the EFI reference, too */
if (test_bit(XFS_EFI_RECOVERED, &efip->efi_flags))
__xfs_efi_release(efip);
+
+ __xfs_efi_release(efip);
+ /* efip may now have been freed, do not reference it again. */
}
}
--
1.7.10.4
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
next prev parent reply other threads:[~2013-05-17 1:12 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-17 1:10 [PATCH 0/5] xfs: fixes for 3.10-rc2 Dave Chinner
2013-05-17 1:10 ` [PATCH 1/5] xfs: fix sub-page blocksize data integrity writes Dave Chinner
2013-05-17 1:10 ` [PATCH 2/5] xfs: fix rounding in xfs_free_file_space Dave Chinner
2013-05-17 1:10 ` Dave Chinner [this message]
2013-05-17 1:10 ` [PATCH 4/5] xfs: avoid nesting transactions in xfs_qm_scall_setqlim() Dave Chinner
2013-05-17 1:10 ` [PATCH 5/5] xfs: fix missing KM_NOFS tags to keep lockdep happy Dave Chinner
2013-05-17 10:15 ` [PATCH 6/5] xfs: xfs_da3_node_read_verify() doesn't handle XFS_ATTR3_LEAF_MAGIC Dave Chinner
2013-05-17 21:43 ` [PATCH 0/5] xfs: fixes for 3.10-rc2 Ben Myers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1368753029-9977-4-git-send-email-david@fromorbit.com \
--to=david@fromorbit.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox