Files
linux/fs/ext2
Pan Bian 4e443d70a1 ext2: fix potential use after free
commit ecebf55d27 upstream.

The function ext2_xattr_set calls brelse(bh) to drop the reference count
of bh. After that, bh may be freed. However, following brelse(bh),
it reads bh->b_data via macro HDR(bh). This may result in a
use-after-free bug. This patch moves brelse(bh) after reading field.

CC: stable@vger.kernel.org
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-05 19:42:40 +01:00
..
2016-09-19 11:30:29 +10:00
2018-05-25 16:12:56 +02:00
2016-09-19 11:30:29 +10:00
2015-02-16 17:56:03 -08:00
2018-12-05 19:42:40 +01:00
2016-02-22 22:35:22 -05:00