lkml.org 
[lkml]   [2021]   [Nov]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 1/2] pipe: fix potential use-after-free in pipe_read()
Date
Accessing buf->flags after pipe_buf_release(pipe, buf) is unsafe, because
the 'buf' memory maybe freed.

Fixes: e7d553d69cf6 ("pipe: Add notification lossage handling")
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
---
fs/pipe.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/pipe.c b/fs/pipe.c
index 6d4342bad9f15b2..302f1e50ce3be1d 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -319,10 +319,12 @@ pipe_read(struct kiocb *iocb, struct iov_iter *to)
}

if (!buf->len) {
+ unsigned int __maybe_unused flags = buf->flags;
+
pipe_buf_release(pipe, buf);
spin_lock_irq(&pipe->rd_wait.lock);
#ifdef CONFIG_WATCH_QUEUE
- if (buf->flags & PIPE_BUF_FLAG_LOSS)
+ if (flags & PIPE_BUF_FLAG_LOSS)
pipe->note_loss = true;
#endif
tail++;
--
2.26.0.106.g9fadedd
\
 
 \ /
  Last update: 2021-11-15 04:59    [W:0.049 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site