This is a note to let you know that I've just added the patch titled afs: Fix a use after free in afs_xattr_get_acl() to the 5.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: afs-fix-a-use-after-free-in-afs_xattr_get_acl.patch and it can be found in the queue-5.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit 83c75ee63f83d734f831c9c3dfa82d606d5df859 Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Date: Mon Aug 24 11:58:12 2020 +0300 afs: Fix a use after free in afs_xattr_get_acl() [ Upstream commit 248c944e2159de4868bef558feea40214aaf8464 ] The "op" pointer is freed earlier when we call afs_put_operation(). Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept") Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Signed-off-by: David Howells <dhowells@xxxxxxxxxx> cc: Colin Ian King <colin.king@xxxxxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/fs/afs/xattr.c b/fs/afs/xattr.c index 84f3c4f575318..38884d6c57cdc 100644 --- a/fs/afs/xattr.c +++ b/fs/afs/xattr.c @@ -85,7 +85,7 @@ static int afs_xattr_get_acl(const struct xattr_handler *handler, if (acl->size <= size) memcpy(buffer, acl->data, acl->size); else - op->error = -ERANGE; + ret = -ERANGE; } }