iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xfs: fix a use after free in xfs_defer_finish_recovery

Browse Source 
dfp will be freed by ->recover_work and thus the tracepoint in case
of an error can lead to a use after free.

Store the defer ops in a local variable to avoid that.

Fixes: 7f2f7531e0 ("xfs: store an ops pointer in struct xfs_defer_pending")
Reported-by: kernel test robot <oliver.sang@intel.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Chandan Babu R <chandanbabu@kernel.org>
This commit is contained in:
Christoph Hellwig 2023-12-28 07:24:09 +00:00 committed by Chandan Babu R
parent 378b6aef9d
commit 4f6ac47b55
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fs/xfs/libxfs/xfs_defer.c
View File

@ -915,12 +915,14 @@ xfs_defer_finish_recovery(
struct xfs_defer_pending *dfp,
struct list_head *capture_list)
{
const struct xfs_defer_op_type *ops = dfp->dfp_ops;
int error;
error = dfp->dfp_ops->recover_work(dfp, capture_list);
/* dfp is freed by recover_work and must not be accessed afterwards */
error = ops->recover_work(dfp, capture_list);
if (error)
trace_xlog_intent_recovery_failed(mp, error,
dfp->dfp_ops->recover_work);
ops->recover_work);
return error;
}