diff options
| author | Chao Yu <yuchao0@huawei.com> | 2020-04-23 17:57:33 +0800 |
|---|---|---|
| committer | Jaegeuk Kim <jaegeuk@kernel.org> | 2020-05-11 20:37:13 -0700 |
| commit | f3494345ce9999624b36109252a4bf5f00e51a46 (patch) | |
| tree | c57303ff36fddfdf9be78c0d1cbef9ba8bc2fef6 /fs/f2fs | |
| parent | 03382f1aa99f438f8e9dc7562c7368f55ba8f56c (diff) | |
| download | linux-stable-f3494345ce9999624b36109252a4bf5f00e51a46.tar.gz linux-stable-f3494345ce9999624b36109252a4bf5f00e51a46.tar.bz2 linux-stable-f3494345ce9999624b36109252a4bf5f00e51a46.zip | |
f2fs: fix potential use-after-free issue
In error path of f2fs_read_multi_pages(), it should let last referrer
release decompress io context memory, otherwise, other referrer will
cause use-after-free issue.
Fixes: 4c8ff7095bef ("f2fs: support data compression")
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Diffstat (limited to 'fs/f2fs')
| -rw-r--r-- | fs/f2fs/data.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 8607c02e8f96..4d871d27a85f 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -2208,16 +2208,16 @@ submit_and_realloc: page->index, for_write); if (IS_ERR(bio)) { ret = PTR_ERR(bio); - bio = NULL; dic->failed = true; if (refcount_sub_and_test(dic->nr_cpages - i, - &dic->ref)) + &dic->ref)) { f2fs_decompress_end_io(dic->rpages, cc->cluster_size, true, false); - f2fs_free_dic(dic); + f2fs_free_dic(dic); + } f2fs_put_dnode(&dn); - *bio_ret = bio; + *bio_ret = NULL; return ret; } } |