Re: [PATCH 1/2] xfs: fix use-after-free when aborting corrupt attr inactivation

Dave Chinner
2020-03-11T05:14:49Z

On Tue, Mar 10, 2020 at 05:47:04PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
>
> Log the corrupt buffer before we release the buffer.
>
> Fixes: a5155b870d687 ("xfs: always log corruption errors")
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
> fs/xfs/xfs_attr_inactive.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>
> diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
> index bbfa6ba84dcd..fe8f60b59ec4 100644
> --- a/fs/xfs/xfs_attr_inactive.c
> +++ b/fs/xfs/xfs_attr_inactive.c
> @@ -145,8 +145,8 @@ xfs_attr3_node_inactive(
> * Since this code is recursive (gasp!) we must protect ourselves.
> */
> if (level > XFS_DA_NODE_MAXDEPTH) {
> - xfs_trans_brelse(*trans, bp); /* no locks for later trans */
> xfs_buf_corruption_error(bp);
> + xfs_trans_brelse(*trans, bp); /* no locks for later trans */

Yup, that needs fixing.

Reviewed-by: Dave Chinner <dchinner@redhat.com>
--
Dave Chinner
david@fromorbit.com