]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
xfs: fix UAF in xchk_btree_check_block_owner
authorDarrick J. Wong <djwong@kernel.org>
Fri, 23 Jan 2026 17:27:39 +0000 (09:27 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 16 Feb 2026 09:19:46 +0000 (10:19 +0100)
commited82e7949f5cac3058f4100f3cd670531d41a266
tree372ce921effb1e0fc11bf30baf8fefd5e5b4c217
parentd741534302f71c511eb0bb670b92eaa7df4a0aec
xfs: fix UAF in xchk_btree_check_block_owner

commit 1c253e11225bc5167217897885b85093e17c2217 upstream.

We cannot dereference bs->cur when trying to determine if bs->cur
aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed.
Fix this by sampling before type before any freeing could happen.
The correct temporal ordering was broken when we removed xfs_btnum_t.

Cc: r772577952@gmail.com
Cc: <stable@vger.kernel.org> # v6.9
Fixes: ec793e690f801d ("xfs: remove xfs_btnum_t")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jiaming Zhang <r772577952@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/xfs/scrub/btree.c