24b4ee7dcb
Author: wuguanghao <wuguanghao3@huawei.com> Date: Mon Mar 14 20:12:17 2022 +0800 (cherry picked from commit feb7ea39582af46f13599e1678473c98965b05c7)
41 lines
1.3 KiB
Diff
41 lines
1.3 KiB
Diff
From e28956c1490593cadd6f5c6bc4b35cd2b3b632d1 Mon Sep 17 00:00:00 2001
|
|
From: "Darrick J. Wong" <darrick.wong@oracle.com>
|
|
Date: Fri, 1 May 2020 17:37:09 -0400
|
|
Subject: [PATCH] xfs: don't ever return a stale pointer from
|
|
__xfs_dir3_free_read
|
|
|
|
Source kernel commit: 1cb5deb5bc095c070c09a4540c45f9c9ba24be43
|
|
|
|
If we decide that a directory free block is corrupt, we must take care
|
|
not to leak a buffer pointer to the caller. After xfs_trans_brelse
|
|
returns, the buffer can be freed or reused, which means that we have to
|
|
set *bpp back to NULL.
|
|
|
|
Callers are supposed to notice the nonzero return value and not use the
|
|
buffer pointer, but we should code more defensively, even if all current
|
|
callers handle this situation correctly.
|
|
|
|
Fixes: de14c5f541e7 ("xfs: verify free block header fields")
|
|
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
|
|
Reviewed-by: Dave Chinner <dchinner@redhat.com>
|
|
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
|
|
---
|
|
libxfs/xfs_dir2_node.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/libxfs/xfs_dir2_node.c b/libxfs/xfs_dir2_node.c
|
|
index ffa136b..c2deafa 100644
|
|
--- a/libxfs/xfs_dir2_node.c
|
|
+++ b/libxfs/xfs_dir2_node.c
|
|
@@ -225,6 +225,7 @@ __xfs_dir3_free_read(
|
|
if (fa) {
|
|
xfs_verifier_error(*bpp, -EFSCORRUPTED, fa);
|
|
xfs_trans_brelse(tp, *bpp);
|
|
+ *bpp = NULL;
|
|
return -EFSCORRUPTED;
|
|
}
|
|
|
|
--
|
|
2.27.0
|
|
|