Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1bb933fb authored by Lukas Czerner's avatar Lukas Czerner Committed by Theodore Ts'o
Browse files

ext4: fix possible use-after-free in ext4_remove_li_request() 



We need to take reference to the s_li_request after we take a mutex,
because it might be freed since then, hence result in accessing old
already freed memory. Also we should protect the whole
ext4_remove_li_request() because ext4_li_info might be in the process of
being freed in ext4_lazyinit_thread().

Signed-off-by: default avatarLukas Czerner <lczerner@redhat.com>
Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: default avatarEric Sandeen <sandeen@redhat.com>
parent 51ce6511

fs/ext4/super.c

+6 −4
Original line number Original line Diff line number Diff line
@@ -2735,14 +2735,16 @@ static void ext4_remove_li_request(struct ext4_li_request *elr) 




static void ext4_unregister_li_request(struct super_block *sb)

static void ext4_unregister_li_request(struct super_block *sb)

{

{

	struct ext4_li_request *elr = EXT4_SB(sb)->s_li_request;

	mutex_lock(&ext4_li_mtx);



	if (!ext4_li_info) {

	if (!ext4_li_info)

		mutex_unlock(&ext4_li_mtx);

		return;

		return;

	}





	mutex_lock(&ext4_li_info->li_list_mtx);

	mutex_lock(&ext4_li_info->li_list_mtx);

	ext4_remove_li_request(elr);

	ext4_remove_li_request(EXT4_SB(sb)->s_li_request);

	mutex_unlock(&ext4_li_info->li_list_mtx);

	mutex_unlock(&ext4_li_info->li_list_mtx);

	mutex_unlock(&ext4_li_mtx);

}

}





static struct task_struct *ext4_lazyinit_task;

static struct task_struct *ext4_lazyinit_task;