xfs
[Top] [All Lists]

Re: xfs: use after free on error in xfs_qm_log_quotaoff()

To: xfs@xxxxxxxxxxx
Subject: Re: xfs: use after free on error in xfs_qm_log_quotaoff()
From: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date: Wed, 15 Oct 2014 16:05:35 +0300
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <20140219095305.GA22351@xxxxxxxxxxxxxx>
References: <20140219095305.GA22351@xxxxxxxxxxxxxx>
User-agent: Mutt/1.5.21 (2010-09-15)
This bug is still around.

regards,
dan carpenter

On Wed, Feb 19, 2014 at 12:53:05PM +0300, Dan Carpenter wrote:
> Smatch complains here.  I don't think I have reported this one before.
> It feels very familiar but I have grepped my outbox.
> 
>       fs/xfs/xfs_qm_syscalls.c:814 xfs_qm_log_quotaoff()
>       warn: 'tp' was already freed.
> 
> fs/xfs/xfs_qm_syscalls.c
>    804          /*
>    805           * We have to make sure that the transaction is secure on 
> disk before we
>    806           * return and actually stop quota accounting. So, make it 
> synchronous.
>    807           * We don't care about quotoff's performance.
>    808           */
>    809          xfs_trans_set_sync(tp);
>    810          error = xfs_trans_commit(tp, 0);
>                         ^^^^^^^^^^^^^^^^
> This function frees tp.
> 
>    811  
>    812  error0:
>    813          if (error) {
>    814                  xfs_trans_cancel(tp, 0);
>                         ^^^^^^^^^^^^^^^^^
> Use after free.
> 
>    815                  /*
>    816                   * No one else is modifying sb_qflags, so this is OK.
>    817                   * We still hold the quotaofflock.
>    818                   */
> 
> regards,
> dan carpenter

<Prev in Thread] Current Thread [Next in Thread>