projects / linux-2.6-block.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 99f5e74) | patch
drivers:md:fix a potential use-after-free bug
authorWentao_Liang <Wentao_Liang_g@163.com>
Thu, 28 Jul 2022 11:39:19 +0000 (19:39 +0800)
committerSong Liu <song@kernel.org>
Thu, 28 Jul 2022 05:51:58 +0000 (22:51 -0700)
commitae0a80935d6a65764b0db00c8b03d3807b4110a6
treebc9c2f26a1ed339164209c6f21a79a201087b494tree
parent99f5e740d961433dd7c59c65850151afc10694adcommit | diff
drivers:md:fix a potential use-after-free bug

In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and
may cause sh to be released. However, sh is subsequently used in lines
2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an
use-after-free bug.

It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of
the function.

Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
Signed-off-by: Song Liu <song@kernel.org>
drivers/md/raid5.c diff | blob | blame | history
Linux 6.x block layer and io_uring tree(s)