From 628b9f6737945c7876faf6012c0edde6405c073f Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 15 Apr 2024 16:07:44 -0700 Subject: [PATCH] xfs: fix a use after free in xfs_defer_finish_recovery Source kernel commit: 4f6ac47b55e3ce6e982807928d6074ec105ab66e dfp will be freed by ->recover_work and thus the tracepoint in case of an error can lead to a use after free. Store the defer ops in a local variable to avoid that. Fixes: 7f2f7531e0d4 ("xfs: store an ops pointer in struct xfs_defer_pending") Reported-by: kernel test robot Signed-off-by: Christoph Hellwig Reviewed-by: "Darrick J. Wong" Signed-off-by: Chandan Babu R Reviewed-by: Bill O'Donnell --- libxfs/xfs_defer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libxfs/xfs_defer.c b/libxfs/xfs_defer.c index 077e9929..5bdc8f5a 100644 --- a/libxfs/xfs_defer.c +++ b/libxfs/xfs_defer.c @@ -909,12 +909,14 @@ xfs_defer_finish_recovery( struct xfs_defer_pending *dfp, struct list_head *capture_list) { + const struct xfs_defer_op_type *ops = dfp->dfp_ops; int error; - error = dfp->dfp_ops->recover_work(dfp, capture_list); + /* dfp is freed by recover_work and must not be accessed afterwards */ + error = ops->recover_work(dfp, capture_list); if (error) trace_xlog_intent_recovery_failed(mp, error, - dfp->dfp_ops->recover_work); + ops->recover_work); return error; } -- 2.47.3