]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
authorBob Peterson <rpeterso@redhat.com>
Tue, 27 Oct 2020 15:10:01 +0000 (10:10 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 18 Nov 2020 18:22:10 +0000 (19:22 +0100)
commitff838a9150ab458bdd0a1c0b0a92ce4325a7e6f4
tree14d19c684d8be5f2233663a2f48942f52747719d
parent5260e09c90be26c17a675e1517fe46c91c16656d
gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free

[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]

Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree.  Fix that by moving the call to kfree below the
call to return_all_reservations.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/gfs2/rgrp.c