lkml.org 
[lkml]   [2022]   [Dec]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] afs: Fix poential UAF in afs_make_call
Date
There is a function call : afs_fs_get_capabilities calls afs_make_call, in
afs_make_call, if error occurs in rxrpc_kernel_send_data, it will call
afs_put_call twice, which will free the call. And the access of
call->state will trigger a use-after-free bug.

Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
fs/afs/rxrpc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index c62939e5ea1f..4871210c4b81 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -422,8 +422,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp)
call->rxcall = NULL;
}
if (call->async) {
- if (cancel_work_sync(&call->async_work))
- afs_put_call(call);
+ cancel_work_sync(&call->async_work);
afs_put_call(call);
}

--
2.25.1
\
 
 \ /
  Last update: 2023-03-26 23:23    [W:0.093 / U:0.284 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site