diff options
| author | Bob Peterson <rpeterso@redhat.com> | 2020-10-27 10:10:01 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-11-18 18:26:26 +0100 |
| commit | 88e168efcd813ffb3c7740994aed5e382d8171fa (patch) | |
| tree | a6e78eda4355c0835e903ad0de28bc07be0f5f9f /fs | |
| parent | bbd97e2c2854e61e4afc937e80bd5c0ac2fc6a7c (diff) | |
| download | linux-stable-88e168efcd813ffb3c7740994aed5e382d8171fa.tar.gz linux-stable-88e168efcd813ffb3c7740994aed5e382d8171fa.tar.bz2 linux-stable-88e168efcd813ffb3c7740994aed5e382d8171fa.zip | |
gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the
call to return_all_reservations.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/gfs2/rgrp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index 0a80f6636549..0958f76ada6a 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -730,9 +730,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) } gfs2_free_clones(rgd); + return_all_reservations(rgd); kfree(rgd->rd_bits); rgd->rd_bits = NULL; - return_all_reservations(rgd); kmem_cache_free(gfs2_rgrpd_cachep, rgd); } } |