OSDN Git Service

gfs2: fix use-after-free in trans_drain
authorBob Peterson <rpeterso@redhat.com>
Thu, 25 Feb 2021 16:11:09 +0000 (11:11 -0500)
committerAndreas Gruenbacher <agruenba@redhat.com>
Sun, 7 Mar 2021 16:04:55 +0000 (17:04 +0100)
commit1a5a2cfd34c17db73c53ef127272c8c1ae220485
tree2239078721418ae2c4ec7acca720e9ec44326c9c
parenteb602521f43876b3f76c4686de596c9804977228
gfs2: fix use-after-free in trans_drain

This patch adds code to function trans_drain to remove drained
bd elements from the ail lists, if queued, before freeing the bd.
If we don't remove the bd from the ail, function ail_drain will
try to reference the bd after it has been freed by trans_drain.

Thanks to Andy Price for his analysis of the problem.

Reported-by: Andy Price <anprice@redhat.com>
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
fs/gfs2/log.c
fs/gfs2/trans.c