From: Eric Sandeen Date: Fri, 7 Mar 2014 01:44:02 +0000 (+1100) Subject: xfsprogs: fix use after free in inode_item_done() X-Git-Tag: v3.2.0-rc1~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fd799f7e3117d2f6ebe99e67ad4bb967ab926bdc;p=thirdparty%2Fxfsprogs-dev.git xfsprogs: fix use after free in inode_item_done() Commit "3a19fb7 libxfs: stop caching inode structures" introduced a use after free. libxfs_iput() already does the check for ip->i_itemp, and a kmem_zone_free() if it's present, and then frees the ip pointer. Re-checking ip->i_itemp after the libxfs_iput call will access the freed ip pointer, as will setting ip_>i_itemp to NULL. Simply remove the offending code to fix this up. Signed-off-by: Eric Sandeen Reviewed-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner --- diff --git a/libxfs/trans.c b/libxfs/trans.c index 6c9d202b7..c44386337 100644 --- a/libxfs/trans.c +++ b/libxfs/trans.c @@ -694,7 +694,6 @@ inode_item_done( xfs_mount_t *mp; xfs_buf_t *bp; int error; - extern kmem_zone_t *xfs_ili_zone; ip = iip->ili_inode; mp = iip->ili_item.li_mountp; @@ -736,15 +735,9 @@ ili_done: if (iip->ili_lock_flags) { iip->ili_lock_flags = 0; return; - } else { - libxfs_iput(ip, 0); } - - if (ip->i_itemp) - kmem_zone_free(xfs_ili_zone, ip->i_itemp); - else - ASSERT(0); - ip->i_itemp = NULL; + /* free the inode */ + libxfs_iput(ip, 0); } static void