xfs: use after free on error in xfs_qm_log_quotaoff()
A message that is not in the archive (sent off-list or not yet received): [email protected]
This bug is still around.
regards,
dan carpenter
Quoted 24 lines · Dan Carpenter
Smatch complains here. I don't think I have reported this one before. It feels very familiar but I have grepped my outbox.
fs/xfs/xfs_qm_syscalls.c:814 xfs_qm_log_quotaoff() warn: 'tp' was already freed.
fs/xfs/xfs_qm_syscalls.c
804 /*805 * We have to make sure that the transaction is secure on disk before we 806 * return and actually stop quota accounting. So, make it synchronous. 807 * We don't care about quotoff's performance. 808 */ 809 xfs_trans_set_sync(tp); 810 error = xfs_trans_commit(tp, 0); ^^^^^^^^^^^^^^^^This function frees tp.
811 812 error0: 813 if (error) { 814 xfs_trans_cancel(tp, 0); ^^^^^^^^^^^^^^^^^Use after free.
Quoted 7 lines
815 /*
816 * No one else is modifying sb_qflags, so this is OK. 817 * We still hold the quotaofflock. 818 */regards,
dan carpenter
_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
Quoted 12 lines · Dan Carpenter
This bug is still around.
regards,
dan carpenterQuoted 6 lines · Dan Carpenter
Smatch complains here. I don't think I have reported this one before. It feels very familiar but I have grepped my outbox.
fs/xfs/xfs_qm_syscalls.c:814 xfs_qm_log_quotaoff() warn: 'tp' was already freed.
Heh, looks like this function also has a problem restoring flags. If the reserve fails we restore flags to 0 rather than the old flags. I'll send a patch shortly.
Brian
Quoted 23 lines
Quoted 23 lines
fs/xfs/xfs_qm_syscalls.c
804 /*805 * We have to make sure that the transaction is secure on disk before we 806 * return and actually stop quota accounting. So, make it synchronous. 807 * We don't care about quotoff's performance. 808 */ 809 xfs_trans_set_sync(tp); 810 error = xfs_trans_commit(tp, 0); ^^^^^^^^^^^^^^^^This function frees tp.
811 812 error0: 813 if (error) { 814 xfs_trans_cancel(tp, 0); ^^^^^^^^^^^^^^^^^Use after free.
815 /*
816 * No one else is modifying sb_qflags, so this is OK. 817 * We still hold the quotaofflock. 818 */
Quoted 7 lines
Quoted 2 lines
regards,
dan carpenter_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs