reiser4: fix a use after free bug in reiser4_parse_options]

PATCH In review Laurent Riffard 4 participants 5 messages Nov 22, 2004 – Nov 23, 2004

lore

Share & tools

lore

Laurent Riffard

author

2004-11-22 20:55 UTC #0 lore raw

PATCH 1/1 reiser4: fix a use after free bug in reiser4_parse_options]

Hello,

I posted this patch last week and nobody replied.

So, if there is no objections, Andrew please apply.

Thank you.

-------- Message original --------
Sujet: [PATCH] reiser4: fix a use after free bug in reiser4_parse_options
Date: Thu, 18 Nov 2004 00:09:36 +0100
De: Laurent Riffard <[email protected]>
Pour: [email protected]

This patch fix a "use after kfree" bug in reiser4_parse_options.

Signed-off-by Laurent Riffard <[email protected]>

---

diff -u linux-2.6-orig/fs/reiser4/vfs_ops.c
linux-2.6/fs/reiser4/vfs_ops.c
--- linux-2.6-orig/fs/reiser4/vfs_ops.c 2004-11-17
23:43:22.186242952 +0100
+++ linux-2.6/fs/reiser4/vfs_ops.c 2004-11-17 23:39:15.935678728 +0100
@@ -1060,8 +1060,6 @@
});
#endif

- kfree(opts);
-
sbinfo->tmgr.atom_max_size = txnmgr_get_max_atom_size(s); sbinfo->tmgr.atom_max_age = REISER4_ATOM_MAX_AGE / HZ; sbinfo->tmgr.atom_max_flushers = ATOM_MAX_FLUSHERS;
@@ -1089,6 +1087,9 @@
sbinfo->ra_params.flags = 0;

result = parse_options(opt_string, opts, p - opts);
+
+ kfree(opts);
+
if (result != 0)
return result;

Signature · 1 line

laurent

Andrew Morton

2004-11-22 22:43 UTC #1 lore raw

Quoted 2 lines · Laurent Riffard

This patch fix a "use after kfree" bug in reiser4_parse_options.

I'll add that to -mm. In future, please don't allow your email client to wordwrap patches. Thanks.

Hans Reiser

2004-11-23 05:21 UTC #2 lore raw

In reply to Laurent Riffard

Apologies, things have been hectic at Namesys.

Vs, please review tomorrow and comment.

Hans

Quoted 45 lines · Laurent Riffard

Hello,
I posted this patch last week and nobody replied.
So, if there is no objections, Andrew please apply.
Thank you.
-------- Message original --------
Sujet: [PATCH] reiser4: fix a use after free bug in reiser4_parse_options
Date: Thu, 18 Nov 2004 00:09:36 +0100
De: Laurent Riffard <[email protected]>
Pour: [email protected]
This patch fix a "use after kfree" bug in reiser4_parse_options.
Signed-off-by Laurent Riffard <[email protected]>
---
diff -u linux-2.6-orig/fs/reiser4/vfs_ops.c
linux-2.6/fs/reiser4/vfs_ops.c
--- linux-2.6-orig/fs/reiser4/vfs_ops.c 2004-11-17
23:43:22.186242952 +0100
+++ linux-2.6/fs/reiser4/vfs_ops.c 2004-11-17 23:39:15.935678728 +0100
(quoted diff) +3 -2
@@ -1060,8 +1060,6 @@
     });
 #endif
 
-    kfree(opts);
-
     sbinfo->tmgr.atom_max_size = txnmgr_get_max_atom_size(s);
     sbinfo->tmgr.atom_max_age = REISER4_ATOM_MAX_AGE / HZ;
     sbinfo->tmgr.atom_max_flushers = ATOM_MAX_FLUSHERS;
@@ -1089,6 +1087,9 @@
     sbinfo->ra_params.flags = 0;
 
     result = parse_options(opt_string, opts, p - opts);
+
+    kfree(opts);
+
     if (result != 0)
         return result;
 

Vladimir Saveliev

2004-11-23 08:11 UTC #3 lore raw

Hello

Quoted 1 line · Hans Reiser

Apologies, things have been hectic at Namesys.

Thanks, Laurent
Your patch is merged in reiser4 bk repository.

Quoted 54 lines

Vs, please review tomorrow and comment.
Hans
Quoted 45 lines · Laurent Riffard
Hello,
I posted this patch last week and nobody replied.
So, if there is no objections, Andrew please apply.
Thank you.
-------- Message original --------
Sujet: [PATCH] reiser4: fix a use after free bug in reiser4_parse_options
Date: Thu, 18 Nov 2004 00:09:36 +0100
De: Laurent Riffard <[email protected]>
Pour: [email protected]
This patch fix a "use after kfree" bug in reiser4_parse_options.
Signed-off-by Laurent Riffard <[email protected]>
---
diff -u linux-2.6-orig/fs/reiser4/vfs_ops.c
linux-2.6/fs/reiser4/vfs_ops.c
--- linux-2.6-orig/fs/reiser4/vfs_ops.c 2004-11-17
23:43:22.186242952 +0100
+++ linux-2.6/fs/reiser4/vfs_ops.c 2004-11-17 23:39:15.935678728 +0100
(quoted diff) +3 -2
@@ -1060,8 +1060,6 @@
     });
 #endif
 
-    kfree(opts);
-
     sbinfo->tmgr.atom_max_size = txnmgr_get_max_atom_size(s);
     sbinfo->tmgr.atom_max_age = REISER4_ATOM_MAX_AGE / HZ;
     sbinfo->tmgr.atom_max_flushers = ATOM_MAX_FLUSHERS;
@@ -1089,6 +1087,9 @@
     sbinfo->ra_params.flags = 0;
 
     result = parse_options(opt_string, opts, p - opts);
+
+    kfree(opts);
+
     if (result != 0)
         return result;
 

Laurent Riffard

author

2004-11-23 20:18 UTC #4 lore raw

Quoted 9 lines · Vladimir Saveliev

Hello
Quoted 1 line · Hans Reiser
Apologies, things have been hectic at Namesys.
Thanks, Laurent
Your patch is merged in reiser4 bk repository.

Thank you for your attention. I wondered to whom a patch should be sent.

Andrew: sorry for the wrapped line, I carefully checked the tab/space conversions and I missed this line.

Signature · 1 line

laurent