Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 476e6c5f authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "ext4: fix use-after-free in dx_release()"

parents 0969a2a4 974f5d1c
Loading
Loading
Loading
Loading
+4 −1
Original line number Diff line number Diff line
@@ -870,12 +870,15 @@ static void dx_release(struct dx_frame *frames)
{
	struct dx_root_info *info;
	int i;
	unsigned int indirect_levels;

	if (frames[0].bh == NULL)
		return;

	info = &((struct dx_root *)frames[0].bh->b_data)->info;
	for (i = 0; i <= info->indirect_levels; i++) {
	/* save local copy, "info" may be freed after brelse() */
	indirect_levels = info->indirect_levels;
	for (i = 0; i <= indirect_levels; i++) {
		if (frames[i].bh == NULL)
			break;
		brelse(frames[i].bh);