Patch "ocfs2: fix a use after free on error" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ocfs2: fix a use after free on error

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ocfs2-fix-a-use-after-free-on-error.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 8883f1e11f458d08403335d5586db319875581a6
Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date:   Wed Feb 24 12:00:41 2021 -0800

    ocfs2: fix a use after free on error
    
    [ Upstream commit c57d117f2b2f2a19b570c36f2819ef8d8210af20 ]
    
    The error handling in this function frees "reg" but it is still on the
    "o2hb_all_regions" list so it will lead to a use after freew.  Joseph Qi
    points out that we need to clear the bit in the "o2hb_region_bitmap" as
    well
    
    Link: https://lkml.kernel.org/r/YBk4M6HUG8jB/jc7@mwanda
    Fixes: 1cf257f51191 ("ocfs2: fix memory leak")
    Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Reviewed-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>
    Cc: Mark Fasheh <mark@xxxxxxxxxx>
    Cc: Joel Becker <jlbec@xxxxxxxxxxxx>
    Cc: Junxiao Bi <junxiao.bi@xxxxxxxxxx>
    Cc: Changwei Ge <gechangwei@xxxxxxx>
    Cc: Gang He <ghe@xxxxxxxx>
    Cc: Jun Piao <piaojun@xxxxxxxxxx>
    Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 0179a73a3fa2c..12a7590601ddb 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -2042,7 +2042,7 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
 			o2hb_nego_timeout_handler,
 			reg, NULL, &reg->hr_handler_list);
 	if (ret)
-		goto free;
+		goto remove_item;
 
 	ret = o2net_register_handler(O2HB_NEGO_APPROVE_MSG, reg->hr_key,
 			sizeof(struct o2hb_nego_msg),
@@ -2057,6 +2057,12 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
 
 unregister_handler:
 	o2net_unregister_handler_list(&reg->hr_handler_list);
+remove_item:
+	spin_lock(&o2hb_live_lock);
+	list_del(&reg->hr_all_item);
+	if (o2hb_global_heartbeat_active())
+		clear_bit(reg->hr_region_num, o2hb_region_bitmap);
+	spin_unlock(&o2hb_live_lock);
 free:
 	kfree(reg);
 	return ERR_PTR(ret);