]>
Commit | Line | Data |
---|---|---|
326a9cc7 GKH |
1 | From 61157b24e60fb3cd1f85f2c76a7b1d628f970144 Mon Sep 17 00:00:00 2001 |
2 | From: Pan Bian <bianpan2016@163.com> | |
3 | Date: Mon, 3 Dec 2018 23:28:02 -0500 | |
4 | Subject: ext4: fix possible use after free in ext4_quota_enable | |
5 | ||
6 | From: Pan Bian <bianpan2016@163.com> | |
7 | ||
8 | commit 61157b24e60fb3cd1f85f2c76a7b1d628f970144 upstream. | |
9 | ||
10 | The function frees qf_inode via iput but then pass qf_inode to | |
11 | lockdep_set_quota_inode on the failure path. This may result in a | |
12 | use-after-free bug. The patch frees df_inode only when it is never used. | |
13 | ||
14 | Fixes: daf647d2dd5 ("ext4: add lockdep annotations for i_data_sem") | |
15 | Cc: stable@kernel.org # 4.6 | |
16 | Reviewed-by: Jan Kara <jack@suse.cz> | |
17 | Signed-off-by: Pan Bian <bianpan2016@163.com> | |
18 | Signed-off-by: Theodore Ts'o <tytso@mit.edu> | |
19 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
20 | ||
21 | --- | |
22 | fs/ext4/super.c | 2 +- | |
23 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
24 | ||
25 | --- a/fs/ext4/super.c | |
26 | +++ b/fs/ext4/super.c | |
27 | @@ -5184,9 +5184,9 @@ static int ext4_quota_enable(struct supe | |
28 | qf_inode->i_flags |= S_NOQUOTA; | |
29 | lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA); | |
30 | err = dquot_enable(qf_inode, type, format_id, flags); | |
31 | - iput(qf_inode); | |
32 | if (err) | |
33 | lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL); | |
34 | + iput(qf_inode); | |
35 | ||
36 | return err; | |
37 | } |