mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-04 16:15:11 +00:00
hfsplus: do not free node before using
[ Upstream commit c7d7d620dc
]
hfs_bmap_free() frees node via hfs_bnode_put(node). However it then
reads node->this when dumping error message on an error path, which may
result in a use-after-free bug. This patch frees node only when it is
never used.
Link: http://lkml.kernel.org/r/1543053441-66942-1-git-send-email-bianpan2016@163.com
Signed-off-by: Pan Bian <bianpan2016@163.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Ernesto A. Fernandez <ernesto.mnd.fernandez@gmail.com>
Cc: Joe Perches <joe@perches.com>
Cc: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
5ee5fa61d0
commit
95c8714e3f
1 changed files with 2 additions and 1 deletions
|
@ -454,14 +454,15 @@ void hfs_bmap_free(struct hfs_bnode *node)
|
|||
|
||||
nidx -= len * 8;
|
||||
i = node->next;
|
||||
hfs_bnode_put(node);
|
||||
if (!i) {
|
||||
/* panic */;
|
||||
pr_crit("unable to free bnode %u. "
|
||||
"bmap not found!\n",
|
||||
node->this);
|
||||
hfs_bnode_put(node);
|
||||
return;
|
||||
}
|
||||
hfs_bnode_put(node);
|
||||
node = hfs_bnode_find(tree, i);
|
||||
if (IS_ERR(node))
|
||||
return;
|
||||
|
|
Loading…
Reference in a new issue