Pan Bian ffaaaf68be ext2: fix potential use after free ...

commit ecebf55d27a11538ea84aee0be643dd953f830d5 upstream.

The function ext2_xattr_set calls brelse(bh) to drop the reference count
of bh. After that, bh may be freed. However, following brelse(bh),
it reads bh->b_data via macro HDR(bh). This may result in a
use-after-free bug. This patch moves brelse(bh) after reading field.

CC: stable@vger.kernel.org
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-12-05 19:32:11 +01:00

..

acl.c

…

acl.h

…

balloc.c

…

dir.c

iversion: Rename make inode_cmp_iversion{+raw} to inode_eq_iversion{+raw}

2018-02-01 08:15:25 -05:00

ext2.h

ext2: add warning when specifying nocheck option

2018-06-20 11:04:26 +02:00

file.c

dax: remove VM_MIXEDMAP for fsdax and device dax

2018-08-17 16:20:27 -07:00

ialloc.c

ext2: make sure that partially set up inodes won't be returned by ext2_iget()

2018-08-03 16:03:31 -04:00

inode.c

ext2, dax: set ext2_dax_aops for dax files

2018-09-19 15:03:04 +02:00

ioctl.c

…

Kconfig

fs/*/Kconfig: drop links to 404-compliant http://acl.bestbits.at

2018-01-01 12:45:37 -07:00

Makefile

…

namei.c

ext2: make sure that partially set up inodes won't be returned by ext2_iget()

2018-08-03 16:03:31 -04:00

super.c

ext2: initialize opts.s_mount_opt as zero before using it

2018-12-05 19:32:11 +01:00

symlink.c

…

xattr_security.c

…

xattr_trusted.c

…

xattr_user.c

…

xattr.c

ext2: fix potential use after free

2018-12-05 19:32:11 +01:00

xattr.h

…