This is a note to let you know that I've just added the patch titled
afs: Fix a use after free in afs_xattr_get_acl()
to the 5.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
afs-fix-a-use-after-free-in-afs_xattr_get_acl.patch
and it can be found in the queue-5.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 83c75ee63f83d734f831c9c3dfa82d606d5df859
Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date: Mon Aug 24 11:58:12 2020 +0300
afs: Fix a use after free in afs_xattr_get_acl()
[ Upstream commit 248c944e2159de4868bef558feea40214aaf8464 ]
The "op" pointer is freed earlier when we call afs_put_operation().
Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept")
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
cc: Colin Ian King <colin.king@xxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/fs/afs/xattr.c b/fs/afs/xattr.c
index 84f3c4f575318..38884d6c57cdc 100644
--- a/fs/afs/xattr.c
+++ b/fs/afs/xattr.c
@@ -85,7 +85,7 @@ static int afs_xattr_get_acl(const struct xattr_handler *handler,
if (acl->size <= size)
memcpy(buffer, acl->data, acl->size);
else
- op->error = -ERANGE;
+ ret = -ERANGE;
}
}
