gfs2: fix use-after-free in trans_drain

Browse source

[ Upstream commit 1a5a2cfd34 ]

This patch adds code to function trans_drain to remove drained
bd elements from the ail lists, if queued, before freeing the bd.
If we don't remove the bd from the ail, function ail_drain will
try to reference the bd after it has been freed by trans_drain.

Thanks to Andy Price for his analysis of the problem.

Reported-by: Andy Price <anprice@redhat.com>
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Bob Peterson 2021-02-25 11:11:09 -05:00 • committed by Greg Kroah-Hartman

parent 419ebba40d

commit 6d7dce3bdf

2 changed files with 6 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

fs/gfs2/log.c

View file

2

fs/gfs2/trans.c

View file