Re: [PATCH] xfsprogs: fix use after free in inode_item_done()

[Roger Willcocks <roger@xxxxxxxxxxxxxxxx>]

On Mon, 2014-03-03 at 16:48 -0600, Eric Sandeen wrote:
> On 3/3/14, 4:36 PM, Dave Chinner wrote:
...
> > which leaves the rest of the ili_done: code looking a little
> > strange.
> > 
> > can you convert that now to be:
> > 
> > ili_done:
> >     if (iip->ili_lock_flags) {
> >             iip->ili_lock_flags = 0;
> >             return;
> >     }
> >     /* free the inode */
> >     libxfs_iput(ip, 0);
> > }
> 
> yeah, I actually had that first.  Not sure why I didn't go with it ;)
> 
> (Still looks strange to my untrained eye; "if lock flags are set, unset them 
> and don't free the inode, otherwise free it")
> 

I'd be tempted to write:

ili_done:
        if (iip->ili_lock_flags == 0) /* don't return locked inode */
                libxfs_iput(ip, 0);

        iip->ili_lock_flags = 0;

-- 
Roger Willcocks <roger@xxxxxxxxxxxxxxxx>