diff options
| author | Naohiro Aota <naota@elisp.net> | 2018-07-13 16:07:20 +0200 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2018-07-13 17:31:35 +0200 |
| commit | 97b191702b05a7cb9fa6d846adba68419cbbc7a6 (patch) | |
| tree | 00bfe21efca70c8504eac5e36715e940efbff446 /LICENSES | |
| parent | btrfs: restore uuid_mutex in btrfs_open_devices (diff) | |
| download | linux-97b191702b05a7cb9fa6d846adba68419cbbc7a6.tar.xz linux-97b191702b05a7cb9fa6d846adba68419cbbc7a6.zip | |
btrfs: fix use-after-free of cmp workspace pages
btrfs_cmp_data_free() puts cmp's src_pages and dst_pages, but leaves
their page address intact. Now, if you hit "goto again" in
btrfs_extent_same_range() and hit some error in
btrfs_cmp_data_prepare(), you'll try to unlock/put already put pages.
This is simple fix to reset the address to avoid use-after-free.
Fixes: 67b07bd4bec5 ("Btrfs: reuse cmp workspace in EXTENT_SAME ioctl")
Signed-off-by: Naohiro Aota <naota@elisp.net>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'LICENSES')
0 files changed, 0 insertions, 0 deletions