From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Pan Bian <bianpan2016@163.com>, Mark Fasheh <mark@fasheh.com>,
Joel Becker <jlbec@evilplan.org>,
Junxiao Bi <junxiao.bi@oracle.com>,
Joseph Qi <jiangqi903@gmail.com>,
Changwei Ge <ge.changwei@h3c.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 3.18 26/26] ocfs2: fix potential use after free
Date: Wed, 5 Dec 2018 04:54:30 -0500 [thread overview]
Message-ID: <20181205095430.8019-26-sashal@kernel.org> (raw)
In-Reply-To: <20181205095430.8019-1-sashal@kernel.org>
From: Pan Bian <bianpan2016@163.com>
[ Upstream commit 164f7e586739d07eb56af6f6d66acebb11f315c8 ]
ocfs2_get_dentry() calls iput(inode) to drop the reference count of
inode, and if the reference count hits 0, inode is freed. However, in
this function, it then reads inode->i_generation, which may result in a
use after free bug. Move the put operation later.
Link: http://lkml.kernel.org/r/1543109237-110227-1-git-send-email-bianpan2016@163.com
Fixes: 781f200cb7a("ocfs2: Remove masklog ML_EXPORT.")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Changwei Ge <ge.changwei@h3c.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/export.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c
index 29651167190d..01ac16b3feac 100644
--- a/fs/ocfs2/export.c
+++ b/fs/ocfs2/export.c
@@ -125,10 +125,10 @@ static struct dentry *ocfs2_get_dentry(struct super_block *sb,
check_gen:
if (handle->ih_generation != inode->i_generation) {
- iput(inode);
trace_ocfs2_get_dentry_generation((unsigned long long)blkno,
handle->ih_generation,
inode->i_generation);
+ iput(inode);
result = ERR_PTR(-ESTALE);
goto bail;
}
--
2.17.1
prev parent reply other threads:[~2018-12-05 9:57 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-05 9:54 [PATCH AUTOSEL 3.18 01/26] ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 02/26] ARM: OMAP1: ams-delta: Fix possible use of uninitialized field Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 03/26] sysv: return 'err' instead of 0 in __sysv_write_inode Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 04/26] s390/cpum_cf: Reject request for sampling in event initialization Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 05/26] hwmon: (w83795) temp4_type has writable permission Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 06/26] Btrfs: send, fix infinite loop due to directory rename dependencies Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 07/26] uprobes: Fix handle_swbp() vs. unregister() + register() race once more Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 08/26] ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 09/26] ASoC: omap-dmic: Add pm_qos handling to avoid overruns " Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 10/26] exportfs: do not read dentry after free Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 11/26] USB: omap_udc: use devm_request_irq() Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 12/26] USB: omap_udc: fix crashes on probe error and module removal Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 13/26] USB: omap_udc: fix omap_udc_start() on 15xx machines Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 14/26] USB: omap_udc: fix USB gadget functionality on Palm Tungsten E Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 15/26] KVM: x86: fix empty-body warnings Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 16/26] rapidio/rionet: do not free skb before reading its length Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 17/26] s390/qeth: fix length check in SNMP processing Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 18/26] drm/ast: fixed reading monitor EDID not stable issue Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 19/26] fscache: fix race between enablement and dropping of object Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 20/26] fscache, cachefiles: remove redundant variable 'cache' Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 21/26] unifdef: use memcpy instead of strncpy Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 22/26] ocfs2: fix deadlock caused by ocfs2_defrag_extent() Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 23/26] hfs: do not free node before using Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 24/26] hfsplus: " Sasha Levin
2018-12-05 9:54 ` [PATCH AUTOSEL 3.18 25/26] debugobjects: avoid recursive calls with kmemleak Sasha Levin
2018-12-05 9:54 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181205095430.8019-26-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=bianpan2016@163.com \
--cc=ge.changwei@h3c.com \
--cc=jiangqi903@gmail.com \
--cc=jlbec@evilplan.org \
--cc=junxiao.bi@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mark@fasheh.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox