From 85b34422c4139eb8070e34104ff5d12034314adc Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Fri, 1 May 2020 17:37:09 -0400 Subject: [PATCH] xfs: don't ever return a stale pointer from __xfs_dir3_free_read Source kernel commit: 1cb5deb5bc095c070c09a4540c45f9c9ba24be43 If we decide that a directory free block is corrupt, we must take care not to leak a buffer pointer to the caller. After xfs_trans_brelse returns, the buffer can be freed or reused, which means that we have to set *bpp back to NULL. Callers are supposed to notice the nonzero return value and not use the buffer pointer, but we should code more defensively, even if all current callers handle this situation correctly. Fixes: de14c5f541e7 ("xfs: verify free block header fields") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Eric Sandeen --- libxfs/xfs_dir2_node.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libxfs/xfs_dir2_node.c b/libxfs/xfs_dir2_node.c index 56eae67e7..48c06da24 100644 --- a/libxfs/xfs_dir2_node.c +++ b/libxfs/xfs_dir2_node.c @@ -225,6 +225,7 @@ __xfs_dir3_free_read( if (fa) { __xfs_buf_mark_corrupt(*bpp, fa); xfs_trans_brelse(tp, *bpp); + *bpp = NULL; return -EFSCORRUPTED; } -- 2.47.2