UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free 

Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree.  Fix that by moving the call to kfree below the
call to return_all_reservations.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
This commit is contained in:
Bob Peterson 2020-10-27 10:10:01 -05:00 committed by Andreas Gruenbacher
parent 4525c8781e
commit d0f17d3883
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/gfs2/rgrp.c
View File

@ -719,9 +719,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
} }
gfs2_free_clones(rgd); gfs2_free_clones(rgd);
return_all_reservations(rgd);
kfree(rgd->rd_bits); kfree(rgd->rd_bits);
rgd->rd_bits = NULL; rgd->rd_bits = NULL;
return_all_reservations(rgd);
kmem_cache_free(gfs2_rgrpd_cachep, rgd); kmem_cache_free(gfs2_rgrpd_cachep, rgd);
} }
} }