xfs
[Top] [All Lists]

Re: [PATCH] xfsprogs: fix use after free in inode_item_done()

To: Eric Sandeen <sandeen@xxxxxxxxxx>
Subject: Re: [PATCH] xfsprogs: fix use after free in inode_item_done()
From: Roger Willcocks <roger@xxxxxxxxxxxxxxxx>
Date: Tue, 04 Mar 2014 13:04:17 +0000
Cc: Dave Chinner <david@xxxxxxxxxxxxx>, xfs-oss <xfs@xxxxxxxxxxx>
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <531506BD.80209@xxxxxxxxxx>
References: <5314E912.9080708@xxxxxxxxxx> <20140303223617.GL13647@dastard> <531506BD.80209@xxxxxxxxxx>
On Mon, 2014-03-03 at 16:48 -0600, Eric Sandeen wrote:
> On 3/3/14, 4:36 PM, Dave Chinner wrote:
...
> > which leaves the rest of the ili_done: code looking a little
> > strange.
> > 
> > can you convert that now to be:
> > 
> > ili_done:
> >     if (iip->ili_lock_flags) {
> >             iip->ili_lock_flags = 0;
> >             return;
> >     }
> >     /* free the inode */
> >     libxfs_iput(ip, 0);
> > }
> 
> yeah, I actually had that first.  Not sure why I didn't go with it ;)
> 
> (Still looks strange to my untrained eye; "if lock flags are set, unset them 
> and don't free the inode, otherwise free it")
> 

I'd be tempted to write:

ili_done:
        if (iip->ili_lock_flags == 0) /* don't return locked inode */
                libxfs_iput(ip, 0);

        iip->ili_lock_flags = 0;

-- 
Roger Willcocks <roger@xxxxxxxxxxxxxxxx>

<Prev in Thread] Current Thread [Next in Thread>