* [PATCH] btrfs: async-thread: Fix a use-after-free error for trace
@ 2016-01-22 1:28 Qu Wenruo
2016-01-22 1:34 ` Chris Mason
2016-01-22 14:03 ` David Sterba
0 siblings, 2 replies; 3+ messages in thread
From: Qu Wenruo @ 2016-01-22 1:28 UTC (permalink / raw)
To: linux-btrfs
Parameter of trace_btrfs_work_queued() can be freed in its workqueue.
So no one use use that pointer after queue_work().
Fix the user-after-free bug by move the trace line before queue_work().
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
---
fs/btrfs/async-thread.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 88d9af3..5fb60ea 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -328,8 +328,8 @@ static inline void __btrfs_queue_work(struct __btrfs_workqueue *wq,
list_add_tail(&work->ordered_list, &wq->ordered_list);
spin_unlock_irqrestore(&wq->list_lock, flags);
}
- queue_work(wq->normal_wq, &work->normal_work);
trace_btrfs_work_queued(work);
+ queue_work(wq->normal_wq, &work->normal_work);
}
void btrfs_queue_work(struct btrfs_workqueue *wq,
--
2.7.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] btrfs: async-thread: Fix a use-after-free error for trace
2016-01-22 1:28 [PATCH] btrfs: async-thread: Fix a use-after-free error for trace Qu Wenruo
@ 2016-01-22 1:34 ` Chris Mason
2016-01-22 14:03 ` David Sterba
1 sibling, 0 replies; 3+ messages in thread
From: Chris Mason @ 2016-01-22 1:34 UTC (permalink / raw)
To: Qu Wenruo; +Cc: linux-btrfs
On Fri, Jan 22, 2016 at 09:28:38AM +0800, Qu Wenruo wrote:
> Parameter of trace_btrfs_work_queued() can be freed in its workqueue.
> So no one use use that pointer after queue_work().
>
> Fix the user-after-free bug by move the trace line before queue_work().
>
> Reported-by: Dave Jones <davej@codemonkey.org.uk>
> Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
> ---
> fs/btrfs/async-thread.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
> index 88d9af3..5fb60ea 100644
> --- a/fs/btrfs/async-thread.c
> +++ b/fs/btrfs/async-thread.c
> @@ -328,8 +328,8 @@ static inline void __btrfs_queue_work(struct __btrfs_workqueue *wq,
> list_add_tail(&work->ordered_list, &wq->ordered_list);
> spin_unlock_irqrestore(&wq->list_lock, flags);
> }
> - queue_work(wq->normal_wq, &work->normal_work);
> trace_btrfs_work_queued(work);
> + queue_work(wq->normal_wq, &work->normal_work);
> }
Thanks
-chris
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] btrfs: async-thread: Fix a use-after-free error for trace
2016-01-22 1:28 [PATCH] btrfs: async-thread: Fix a use-after-free error for trace Qu Wenruo
2016-01-22 1:34 ` Chris Mason
@ 2016-01-22 14:03 ` David Sterba
1 sibling, 0 replies; 3+ messages in thread
From: David Sterba @ 2016-01-22 14:03 UTC (permalink / raw)
To: Qu Wenruo; +Cc: linux-btrfs
On Fri, Jan 22, 2016 at 09:28:38AM +0800, Qu Wenruo wrote:
> Parameter of trace_btrfs_work_queued() can be freed in its workqueue.
> So no one use use that pointer after queue_work().
>
> Fix the user-after-free bug by move the trace line before queue_work().
>
> Reported-by: Dave Jones <davej@codemonkey.org.uk>
> Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
Reviewed-by: David Sterba <dsterba@suse.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-01-22 14:03 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-01-22 1:28 [PATCH] btrfs: async-thread: Fix a use-after-free error for trace Qu Wenruo
2016-01-22 1:34 ` Chris Mason
2016-01-22 14:03 ` David Sterba
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.