diff mbox series

[1/2] xfs: fix use-after-free when aborting corrupt attr inactivation

Message ID 158388762432.939081.11036027889087941270.stgit@magnolia (mailing list archive)
State Accepted
Headers show
Series xfs: random fixes | expand

Commit Message

Darrick J. Wong March 11, 2020, 12:47 a.m. UTC
From: Darrick J. Wong <darrick.wong@oracle.com>

Log the corrupt buffer before we release the buffer.

Fixes: a5155b870d687 ("xfs: always log corruption errors")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/xfs_attr_inactive.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Dave Chinner March 11, 2020, 5:14 a.m. UTC | #1
On Tue, Mar 10, 2020 at 05:47:04PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Log the corrupt buffer before we release the buffer.
> 
> Fixes: a5155b870d687 ("xfs: always log corruption errors")
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
>  fs/xfs/xfs_attr_inactive.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> 
> diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
> index bbfa6ba84dcd..fe8f60b59ec4 100644
> --- a/fs/xfs/xfs_attr_inactive.c
> +++ b/fs/xfs/xfs_attr_inactive.c
> @@ -145,8 +145,8 @@ xfs_attr3_node_inactive(
>  	 * Since this code is recursive (gasp!) we must protect ourselves.
>  	 */
>  	if (level > XFS_DA_NODE_MAXDEPTH) {
> -		xfs_trans_brelse(*trans, bp);	/* no locks for later trans */
>  		xfs_buf_corruption_error(bp);
> +		xfs_trans_brelse(*trans, bp);	/* no locks for later trans */

Yup, that needs fixing.

Reviewed-by: Dave Chinner <dchinner@redhat.com>
Christoph Hellwig March 11, 2020, 6:35 a.m. UTC | #2
On Tue, Mar 10, 2020 at 05:47:04PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Log the corrupt buffer before we release the buffer.

Oops,

looks correct:

Reviewed-by: Christoph Hellwig <hch@lst.de>
diff mbox series

Patch

diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
index bbfa6ba84dcd..fe8f60b59ec4 100644
--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -145,8 +145,8 @@  xfs_attr3_node_inactive(
 	 * Since this code is recursive (gasp!) we must protect ourselves.
 	 */
 	if (level > XFS_DA_NODE_MAXDEPTH) {
-		xfs_trans_brelse(*trans, bp);	/* no locks for later trans */
 		xfs_buf_corruption_error(bp);
+		xfs_trans_brelse(*trans, bp);	/* no locks for later trans */
 		return -EFSCORRUPTED;
 	}