Re: [PATCH] nilfs2: fix potential use after free

2018-12-03 Thread PanBian
On Mon, Dec 03, 2018 at 06:10:51PM +0900, Ryusuke Konishi wrote: > Hi, Pan Bian > > Thank you for feeding back this patch. > I reviewed this and am thinking this must be sent to upstream. > > Did you see any kernel oops on this bug ? Not yet. In fact, I found it with a static method. Best

Re: [PATCH] nilfs2: fix potential use after free

2018-12-03 Thread PanBian
On Mon, Dec 03, 2018 at 06:10:51PM +0900, Ryusuke Konishi wrote: > Hi, Pan Bian > > Thank you for feeding back this patch. > I reviewed this and am thinking this must be sent to upstream. > > Did you see any kernel oops on this bug ? Not yet. In fact, I found it with a static method. Best

Re: [PATCH] nilfs2: fix potential use after free

2018-12-03 Thread Ryusuke Konishi
Hi, Pan Bian Thank you for feeding back this patch. I reviewed this and am thinking this must be sent to upstream. Did you see any kernel oops on this bug ? Regards, Ryusuke Konishi On Mon, 26 Nov 2018 11:08:29 +0800, Pan Bian wrote: > brelse(bh) is called to drop the reference count of bh

Re: [PATCH] nilfs2: fix potential use after free

2018-12-03 Thread Ryusuke Konishi
Hi, Pan Bian Thank you for feeding back this patch. I reviewed this and am thinking this must be sent to upstream. Did you see any kernel oops on this bug ? Regards, Ryusuke Konishi On Mon, 26 Nov 2018 11:08:29 +0800, Pan Bian wrote: > brelse(bh) is called to drop the reference count of bh

[PATCH] nilfs2: fix potential use after free

2018-11-25 Thread Pan Bian
brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate fails. If the reference count hits 0, bh may be freed. However, bh->b_page is unlocked and put after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking

[PATCH] nilfs2: fix potential use after free

2018-11-25 Thread Pan Bian
brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate fails. If the reference count hits 0, bh may be freed. However, bh->b_page is unlocked and put after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking