diff options
| author | Bob Peterson <rpeterso@redhat.com> | 2021-02-25 17:11:09 +0100 |
|---|---|---|
| committer | Andreas Gruenbacher <agruenba@redhat.com> | 2021-03-07 17:04:55 +0100 |
| commit | 1a5a2cfd34c17db73c53ef127272c8c1ae220485 (patch) | |
| tree | 2239078721418ae2c4ec7acca720e9ec44326c9c /fs/gfs2/trans.c | |
| parent | gfs2: make function gfs2_make_fs_ro() to void type (diff) | |
| download | linux-1a5a2cfd34c17db73c53ef127272c8c1ae220485.tar.xz linux-1a5a2cfd34c17db73c53ef127272c8c1ae220485.zip | |
gfs2: fix use-after-free in trans_drain
This patch adds code to function trans_drain to remove drained
bd elements from the ail lists, if queued, before freeing the bd.
If we don't remove the bd from the ail, function ail_drain will
try to reference the bd after it has been freed by trans_drain.
Thanks to Andy Price for his analysis of the problem.
Reported-by: Andy Price <anprice@redhat.com>
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Diffstat (limited to 'fs/gfs2/trans.c')
| -rw-r--r-- | fs/gfs2/trans.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c index ab96cf0bf26b..63fec11ef2ce 100644 --- a/fs/gfs2/trans.c +++ b/fs/gfs2/trans.c @@ -169,6 +169,8 @@ static struct gfs2_bufdata *gfs2_alloc_bufdata(struct gfs2_glock *gl, bd->bd_bh = bh; bd->bd_gl = gl; INIT_LIST_HEAD(&bd->bd_list); + INIT_LIST_HEAD(&bd->bd_ail_st_list); + INIT_LIST_HEAD(&bd->bd_ail_gl_list); bh->b_private = bd; return bd; } |