hfs: fix potential use after free in hfs_correct_next_unused_CNID()
Subsystems (3)
PATCH 1/1 hfs: fix potential use after free in hfs_correct_next_unused_CNID()
This code calls hfs_bnode_put(node) which drops the refcount and then dreferences "node" on the next line. It's only safe to use "node" when we're holding a reference so flip these two lines around.
Fixes a06ec283e125 ("hfs: add logic of correcting a next unused CNID")
Signed-off-by Dan Carpenter <[email protected]>
--- fs/hfs/catalog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/hfs/catalog.c +1 -1
@@ -322,9 +322,9 @@ int hfs_correct_next_unused_CNID(struct super_block *sb, u32 cnid) } } + node_id = node->prev;hfs_bnode_put (node); - node_id = node->prev; }while (node_id >= leaf_head);return -ENOENT ;
Signature · 1 line
2.51.0
Quoted 15 lines · Dan Carpenter
This code calls
hfs_bnode_put(node)which drops the refcount and then dreferences "node" on the next line. It's only safe to use "node" when we're holding a reference so flip these two lines around.Fixes a06ec283e125 ("hfs: add logic of correcting a next unused CNID")Signed-off-by Dan Carpenter <[email protected]>--- fs/hfs/catalog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)fs/hfs/catalog.c +0
-0
fs/hfs/catalog.c int hfs_correct_next_unused_CNID(struct super_block *sb, u32 cnid) · line 330
Quoted 10 lines
fs/hfs/catalog.c +1
-1@@ -322,9 +322,9 @@ int hfs_correct_next_unused_CNID(struct super_block *sb, u32 cnid) } } + node_id = node->prev;hfs_bnode_put (node); - node_id = node->prev; }while (node_id >= leaf_head);return -ENOENT ;
Yeah, makes sense. Good catch. :) I missed this. Thanks a lot for the fix.
Reviewed-by Viacheslav Dubeyko <[email protected]>
Thanks,
Slava.