github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-27 08:33:17 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bcachefs: Fix UAF in __promote_alloc() error path

Browse Source 
If we error in data_update_init() after adding to the rhashtable of
outstanding promotes, kfree_rcu() is required.

Reported-by: Reed Riley <reed@riley.engineer>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
This commit is contained in:
Kent Overstreet 2024-11-06 16:40:08 -05:00
parent f9f0a5390d
commit 8440da9331
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/bcachefs/io_read.c
View File

@ -262,7 +262,8 @@ static struct promote_op *__promote_alloc(struct btree_trans *trans,
bio_free_pages(&(*rbio)->bio);
kfree(*rbio);
*rbio = NULL;
kfree(op);
/* We may have added to the rhashtable and thus need rcu freeing: */
kfree_rcu(op, rcu);
bch2_write_ref_put(c, BCH_WRITE_REF_promote);
return ERR_PTR(ret);
}