From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD109C4727C for ; Tue, 29 Sep 2020 12:28:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7F2182083B for ; Tue, 29 Sep 2020 12:28:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601382493; bh=XMOfvOr1lxFIco/mbVluSf0TkpSIgUsFDoDSdZjzJrw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=pWoAQhNJdS1jYsmBLmY3S3AxlNP5A2axfG3ThkkRlI92XnvU4sIIW9z/cgrp3bEjO IE7tSdWDQBwzZ8Il0qILN6O7VG5PD8hzzCmRlcCbW6phQmJCBgcrCkAeJp9/SYThXi FjJoeTU5b3ioWULyYsAI3ks7OGq6t9eknLaYgNG0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732537AbgI2M2L (ORCPT ); Tue, 29 Sep 2020 08:28:11 -0400 Received: from mail.kernel.org ([198.145.29.99]:47764 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728919AbgI2Lcy (ORCPT ); Tue, 29 Sep 2020 07:32:54 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 87CD223B28; Tue, 29 Sep 2020 11:25:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601378748; bh=XMOfvOr1lxFIco/mbVluSf0TkpSIgUsFDoDSdZjzJrw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PY85BxmSk2kn16vLsfkuOUOgJZo8hBMuu9SR6k8h7Nx6BvWJ2xOUCuVu7OkDa1Xlh Bj1lfEGZpy/EZDIP2FqkzPdXLAf9NXfNyrNmzkHwfZfdzmSY37NIRdljhNFFcCPSzW V9ijJ1btDIXtDRYHR8kqxCcEznZ2ZRKST8fdDy/c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Darrick J. Wong" , Dave Chinner , Sasha Levin Subject: [PATCH 4.19 107/245] xfs: dont ever return a stale pointer from __xfs_dir3_free_read Date: Tue, 29 Sep 2020 12:59:18 +0200 Message-Id: <20200929105952.210570551@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200929105946.978650816@linuxfoundation.org> References: <20200929105946.978650816@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Darrick J. Wong [ Upstream commit 1cb5deb5bc095c070c09a4540c45f9c9ba24be43 ] If we decide that a directory free block is corrupt, we must take care not to leak a buffer pointer to the caller. After xfs_trans_brelse returns, the buffer can be freed or reused, which means that we have to set *bpp back to NULL. Callers are supposed to notice the nonzero return value and not use the buffer pointer, but we should code more defensively, even if all current callers handle this situation correctly. Fixes: de14c5f541e7 ("xfs: verify free block header fields") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Sasha Levin --- fs/xfs/libxfs/xfs_dir2_node.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c index f1bb3434f51c7..01e99806b941f 100644 --- a/fs/xfs/libxfs/xfs_dir2_node.c +++ b/fs/xfs/libxfs/xfs_dir2_node.c @@ -214,6 +214,7 @@ __xfs_dir3_free_read( if (fa) { xfs_verifier_error(*bpp, -EFSCORRUPTED, fa); xfs_trans_brelse(tp, *bpp); + *bpp = NULL; return -EFSCORRUPTED; } -- 2.25.1