]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
authorBob Peterson <rpeterso@redhat.com>
Tue, 27 Oct 2020 15:10:01 +0000 (10:10 -0500)
committerStefan Bader <stefan.bader@canonical.com>
Thu, 10 Dec 2020 11:06:19 +0000 (12:06 +0100)
commitc1c72eda54f763cdda0ace111e65603abec0d00a
treea2c75e934b73a00973ab8d773921ef2401182465
parentf5bf522a0f63b3a34036cc115b0d8829c6551a18
gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free

BugLink: https://bugs.launchpad.net/bugs/1905618
[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]

Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree.  Fix that by moving the call to kfree below the
call to return_all_reservations.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
fs/gfs2/rgrp.c