diff options
| author | Sahitya Tummala <stummala@codeaurora.org> | 2018-12-26 11:20:29 +0530 |
|---|---|---|
| committer | Jaegeuk Kim <jaegeuk@kernel.org> | 2018-12-26 15:18:10 -0800 |
| commit | 60aa4d5536ab7fe32433ca1173bd9d6633851f27 (patch) | |
| tree | 8ed8366020971bf2bd773804ed058e1ae124a46a /fs/f2fs/xattr.c | |
| parent | bae0ee7a767ceeea6d8e170da3f228fbc7480331 (diff) | |
| download | linux-rt-60aa4d5536ab7fe32433ca1173bd9d6633851f27.tar.gz | |
f2fs: fix use-after-free issue when accessing sbi->stat_info
iput() on sbi->node_inode can update sbi->stat_info
in the below context, if the f2fs_write_checkpoint()
has failed with error.
f2fs_balance_fs_bg+0x1ac/0x1ec
f2fs_write_node_pages+0x4c/0x260
do_writepages+0x80/0xbc
__writeback_single_inode+0xdc/0x4ac
writeback_single_inode+0x9c/0x144
write_inode_now+0xc4/0xec
iput+0x194/0x22c
f2fs_put_super+0x11c/0x1e8
generic_shutdown_super+0x70/0xf4
kill_block_super+0x2c/0x5c
kill_f2fs_super+0x44/0x50
deactivate_locked_super+0x60/0x8c
deactivate_super+0x68/0x74
cleanup_mnt+0x40/0x78
Fix this by moving f2fs_destroy_stats() further below iput() in
both f2fs_put_super() and f2fs_fill_super() paths.
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Diffstat (limited to 'fs/f2fs/xattr.c')
0 files changed, 0 insertions, 0 deletions