xfs
[Top] [All Lists]

Re: xfs: use after free on error in xfs_qm_log_quotaoff()

To: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Subject: Re: xfs: use after free on error in xfs_qm_log_quotaoff()
From: Brian Foster <bfoster@xxxxxxxxxx>
Date: Thu, 16 Oct 2014 09:28:13 -0400
Cc: xfs@xxxxxxxxxxx
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <20141015130535.GN26918@mwanda>
References: <20140219095305.GA22351@xxxxxxxxxxxxxx> <20141015130535.GN26918@mwanda>
User-agent: Mutt/1.5.23 (2014-03-12)
On Wed, Oct 15, 2014 at 04:05:35PM +0300, Dan Carpenter wrote:
> This bug is still around.
> 
> regards,
> dan carpenter
> 
> On Wed, Feb 19, 2014 at 12:53:05PM +0300, Dan Carpenter wrote:
> > Smatch complains here.  I don't think I have reported this one before.
> > It feels very familiar but I have grepped my outbox.
> > 
> >     fs/xfs/xfs_qm_syscalls.c:814 xfs_qm_log_quotaoff()
> >     warn: 'tp' was already freed.
> > 

Heh, looks like this function also has a problem restoring flags. If the
reserve fails we restore flags to 0 rather than the old flags. I'll send
a patch shortly.

Brian

> > fs/xfs/xfs_qm_syscalls.c
> >    804          /*
> >    805           * We have to make sure that the transaction is secure on 
> > disk before we
> >    806           * return and actually stop quota accounting. So, make it 
> > synchronous.
> >    807           * We don't care about quotoff's performance.
> >    808           */
> >    809          xfs_trans_set_sync(tp);
> >    810          error = xfs_trans_commit(tp, 0);
> >                         ^^^^^^^^^^^^^^^^
> > This function frees tp.
> > 
> >    811  
> >    812  error0:
> >    813          if (error) {
> >    814                  xfs_trans_cancel(tp, 0);
> >                         ^^^^^^^^^^^^^^^^^
> > Use after free.
> > 
> >    815                  /*
> >    816                   * No one else is modifying sb_qflags, so this is 
> > OK.
> >    817                   * We still hold the quotaofflock.
> >    818                   */
> > 
> > regards,
> > dan carpenter
> 
> _______________________________________________
> xfs mailing list
> xfs@xxxxxxxxxxx
> http://oss.sgi.com/mailman/listinfo/xfs

<Prev in Thread] Current Thread [Next in Thread>