From: Dan Carpenter <dan.carpenter@oracle.com>
To: xfs@oss.sgi.com
Subject: Re: xfs: use after free on error in xfs_qm_log_quotaoff()
Date: Wed, 15 Oct 2014 16:05:35 +0300 [thread overview]
Message-ID: <20141015130535.GN26918@mwanda> (raw)
In-Reply-To: <20140219095305.GA22351@elgon.mountain>
This bug is still around.
regards,
dan carpenter
On Wed, Feb 19, 2014 at 12:53:05PM +0300, Dan Carpenter wrote:
> Smatch complains here. I don't think I have reported this one before.
> It feels very familiar but I have grepped my outbox.
>
> fs/xfs/xfs_qm_syscalls.c:814 xfs_qm_log_quotaoff()
> warn: 'tp' was already freed.
>
> fs/xfs/xfs_qm_syscalls.c
> 804 /*
> 805 * We have to make sure that the transaction is secure on disk before we
> 806 * return and actually stop quota accounting. So, make it synchronous.
> 807 * We don't care about quotoff's performance.
> 808 */
> 809 xfs_trans_set_sync(tp);
> 810 error = xfs_trans_commit(tp, 0);
> ^^^^^^^^^^^^^^^^
> This function frees tp.
>
> 811
> 812 error0:
> 813 if (error) {
> 814 xfs_trans_cancel(tp, 0);
> ^^^^^^^^^^^^^^^^^
> Use after free.
>
> 815 /*
> 816 * No one else is modifying sb_qflags, so this is OK.
> 817 * We still hold the quotaofflock.
> 818 */
>
> regards,
> dan carpenter
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
next parent reply other threads:[~2014-10-15 13:05 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20140219095305.GA22351@elgon.mountain>
2014-10-15 13:05 ` Dan Carpenter [this message]
2014-10-16 13:28 ` xfs: use after free on error in xfs_qm_log_quotaoff() Brian Foster
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141015130535.GN26918@mwanda \
--to=dan.carpenter@oracle.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox