diff options
| author | Mikulas Patocka <mpatocka@redhat.com> | 2022-06-16 13:21:27 -0400 |
|---|---|---|
| committer | Mike Snitzer <snitzer@kernel.org> | 2022-06-16 19:38:49 -0400 |
| commit | 5d7362d0d56da3b85b19b5e5ce657026c2eef479 (patch) | |
| tree | cd80ec66ee3d3574d43c72f77a5185ff85e366dd /scripts/gdb/linux/timerlist.py | |
| parent | 10eb3a0d517fcc83eeea4242c149461205675eb4 (diff) | |
dm: fix use-after-free in dm_put_live_table_bio
dm_put_live_table_bio is called from the end of dm_submit_bio.
However, at this point, the bio may be already finished and the caller
may have freed the bio. Consequently, dm_put_live_table_bio accesses
the stale "bio" pointer.
Fix this bug by loading the bi_opf value and passing it to
dm_get_live_table_bio and dm_put_live_table_bio instead of the bio.
This bug was found by running the lvm2 testsuite with kasan.
Fixes: 563a225c9fd2 ("dm: introduce dm_{get,put}_live_table_bio called from dm_submit_bio")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Diffstat (limited to 'scripts/gdb/linux/timerlist.py')
0 files changed, 0 insertions, 0 deletions