Subject: + ocfs2-fix-possible-double-free-in-ocfs2_reflink_xattr_rec.patch added to -mm tree To: joseph.qi@xxxxxxxxxx,jeff.liu@xxxxxxxxxx,jlbec@xxxxxxxxxxxx,mfasheh@xxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Thu, 08 Aug 2013 15:20:16 -0700 The patch titled Subject: ocfs2: fix possible double free in ocfs2_reflink_xattr_rec has been added to the -mm tree. Its filename is ocfs2-fix-possible-double-free-in-ocfs2_reflink_xattr_rec.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/ocfs2-fix-possible-double-free-in-ocfs2_reflink_xattr_rec.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/ocfs2-fix-possible-double-free-in-ocfs2_reflink_xattr_rec.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Joseph Qi <joseph.qi@xxxxxxxxxx> Subject: ocfs2: fix possible double free in ocfs2_reflink_xattr_rec In ocfs2_reflink_xattr_rec(), meta_ac and data_ac are allocated by calling ocfs2_lock_reflink_xattr_rec_allocators(). Once an error occurs when allocating *data_ac, it frees *meta_ac which is allocated before. Here it mistakenly sets meta_ac to NULL but *meta_ac. Then ocfs2_reflink_xattr_rec() will try to free meta_ac again which is already invalid. Signed-off-by: Joseph Qi <joseph.qi@xxxxxxxxxx> Reviewed-by: Jie Liu <jeff.liu@xxxxxxxxxx> Cc: Mark Fasheh <mfasheh@xxxxxxxx> Cc: Joel Becker <jlbec@xxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/ocfs2/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN fs/ocfs2/xattr.c~ocfs2-fix-possible-double-free-in-ocfs2_reflink_xattr_rec fs/ocfs2/xattr.c --- a/fs/ocfs2/xattr.c~ocfs2-fix-possible-double-free-in-ocfs2_reflink_xattr_rec +++ a/fs/ocfs2/xattr.c @@ -6802,7 +6802,7 @@ out: if (ret) { if (*meta_ac) { ocfs2_free_alloc_context(*meta_ac); - meta_ac = NULL; + *meta_ac = NULL; } } _ Patches currently in -mm which might be from joseph.qi@xxxxxxxxxx are fs-ocfs2-cluster-tcpc-fix-possible-null-pointer-dereferences.patch ocfs2-clean-up-dead-code-in-ocfs2_acl_from_xattr.patch ocfs2-add-missing-return-value-check-of-ocfs2_get_clusters.patch ocfs2-add-the-missing-return-value-check-of-ocfs2_xattr_get_clusters.patch ocfs2-free-meta_ac-and-data_ac-when-ocfs2_start_trans-fails-in-ocfs2_xattr_set.patch ocfs2-fix-possible-double-free-in-ocfs2_reflink_xattr_rec.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html