diff options
| author | Bob Peterson <rpeterso@redhat.com> | 2021-02-25 11:11:09 -0500 |
|---|---|---|
| committer | Andreas Gruenbacher <agruenba@redhat.com> | 2021-03-07 17:04:55 +0100 |
| commit | 1a5a2cfd34c17db73c53ef127272c8c1ae220485 (patch) | |
| tree | 2239078721418ae2c4ec7acca720e9ec44326c9c /drivers | |
| parent | eb602521f43876b3f76c4686de596c9804977228 (diff) | |
| download | lwn-1a5a2cfd34c17db73c53ef127272c8c1ae220485.tar.gz lwn-1a5a2cfd34c17db73c53ef127272c8c1ae220485.zip | |
gfs2: fix use-after-free in trans_drain
This patch adds code to function trans_drain to remove drained
bd elements from the ail lists, if queued, before freeing the bd.
If we don't remove the bd from the ail, function ail_drain will
try to reference the bd after it has been freed by trans_drain.
Thanks to Andy Price for his analysis of the problem.
Reported-by: Andy Price <anprice@redhat.com>
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Diffstat (limited to 'drivers')
0 files changed, 0 insertions, 0 deletions