• Andrew Morton's avatar
    [PATCH] ext3: fix use-after-free bug · 7dbfb92c
    Andrew Morton authored
    ext3_writepage() calls ext3_journal_stop(), which dereferences the affected
    inode.
    
    It does this _after_ writing the page out, which is illegal.  The IO can
    complete, the page can be repeased from the inode and the inode can be freed
    up.
    
    It's a long-standing bug.  It has been reported happening on preemptible
    kernels, where the timing window is larger.
    
    Fix that up by teaching ext3_journal_stop to locate the superblock via the
    journal structure, not via the inode.
    
    This means that ext3_journal_stop() does not need the inode argument at all.
    
    Also uninline the affected functions.  It saves 5.5 kbytes.
    
    Also remove the setting of sb->s_dirt in ext3_journal_stop().  That was an
    awkward way of telling sys_sync() that the filesystem needs a commit, and
    with the ext3_sync_fs() that is no longer needed.
    7dbfb92c
xattr.c 31.3 KB