linux-kernel - Re: [patch 5/5] fs: fix bdi writeback use after free 2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090915192930.GQ23126@kernel.dk>
Date:	Tue, 15 Sep 2009 21:29:30 +0200
From:	Jens Axboe <jens.axboe@...cle.com>
To:	npiggin@...e.de
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org
Subject: Re: [patch 5/5] fs: fix bdi writeback use after free 2

On Wed, Sep 16 2009, npiggin@...e.de wrote:
> work can be gone after wb_clear_pending, so load the sb from it first.

This one is already moot, I fixed that in an earlier patch.

> 
> Signed-off-by: Nick Piggin <npiggin@...e.de>
> ---
>  fs/fs-writeback.c |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> Index: linux-2.6/fs/fs-writeback.c
> ===================================================================
> --- linux-2.6.orig/fs/fs-writeback.c
> +++ linux-2.6/fs/fs-writeback.c
> @@ -783,6 +783,7 @@ long wb_do_writeback(struct bdi_writebac
>  
>  	while ((work = get_next_work_item(bdi, wb)) != NULL) {
>  		enum writeback_sync_modes sync_mode;
> +		struct super_block *sb;
>  
>  		nr_pages = work->nr_pages;
>  
> @@ -794,6 +795,8 @@ long wb_do_writeback(struct bdi_writebac
>  		else
>  			sync_mode = work->sync_mode;
>  
> +		sb = work->sb;
> +
>  		/*
>  		 * If this isn't a data integrity operation, just notify
>  		 * that we have seen this work and we are now starting it.
> @@ -801,7 +804,7 @@ long wb_do_writeback(struct bdi_writebac
>  		if (sync_mode == WB_SYNC_NONE)
>  			wb_clear_pending(wb, work);
>  
> -		wrote += wb_writeback(wb, nr_pages, work->sb, sync_mode, 0);
> +		wrote += wb_writeback(wb, nr_pages, sb, sync_mode, 0);
>  
>  		/*
>  		 * This is a data integrity writeback, so only do the
> 
> 

-- 
Jens Axboe

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/