From patchwork Tue Sep 29 10:58:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 290964 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44F5DC4727C for ; Tue, 29 Sep 2020 12:06:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 06CD820684 for ; Tue, 29 Sep 2020 12:06:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601381166; bh=o+eAp/Ndr66M8Nkw733LzW79K/soAjq5YBrO1TFNnIk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=CZf9h9ABf4UdkksdOdx4JrGsDhHVRinBH+S+5RA1iK8B4oLRBta9a5d0cd9CvWtzJ oGD3uhN12uA3+nFa1un7sDw8jYQ1enio07oB0sn4xA6h7AUDR+mLpoPJi4YOFO94UD jbPLUEHierq16dR5KT7sRZAsVyMahu/WNvUcRKb0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730465AbgI2MFv (ORCPT ); Tue, 29 Sep 2020 08:05:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:50296 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730002AbgI2Lhh (ORCPT ); Tue, 29 Sep 2020 07:37:37 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CE7D323BDD; Tue, 29 Sep 2020 11:37:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601379441; bh=o+eAp/Ndr66M8Nkw733LzW79K/soAjq5YBrO1TFNnIk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ghE0n4hCHpd98mUviFmapN3k4SJ8XFtr1B8esD9zhNkOPTD0wL2awqWPPMrrKapyp Jlj1mypaGzAdi2YchdbWxXGTgGQl9pBm1/9VS6Q5/WyR4IiFA9I9vWsVWSyqdgg7lq fokT2dVMwXYnCHikIvTn5nrsi3fFfEUcIb82Uxn8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Darrick J. Wong" , Dave Chinner , Sasha Levin Subject: [PATCH 5.4 165/388] xfs: dont ever return a stale pointer from __xfs_dir3_free_read Date: Tue, 29 Sep 2020 12:58:16 +0200 Message-Id: <20200929110018.468625692@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200929110010.467764689@linuxfoundation.org> References: <20200929110010.467764689@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Darrick J. Wong [ Upstream commit 1cb5deb5bc095c070c09a4540c45f9c9ba24be43 ] If we decide that a directory free block is corrupt, we must take care not to leak a buffer pointer to the caller. After xfs_trans_brelse returns, the buffer can be freed or reused, which means that we have to set *bpp back to NULL. Callers are supposed to notice the nonzero return value and not use the buffer pointer, but we should code more defensively, even if all current callers handle this situation correctly. Fixes: de14c5f541e7 ("xfs: verify free block header fields") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Sasha Levin --- fs/xfs/libxfs/xfs_dir2_node.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c index 705c4f5627582..99d5b2ed67f2e 100644 --- a/fs/xfs/libxfs/xfs_dir2_node.c +++ b/fs/xfs/libxfs/xfs_dir2_node.c @@ -210,6 +210,7 @@ __xfs_dir3_free_read( if (fa) { xfs_verifier_error(*bpp, -EFSCORRUPTED, fa); xfs_trans_brelse(tp, *bpp); + *bpp = NULL; return -EFSCORRUPTED; }