]> git.baikalelectronics.ru Git - kernel.git/commit
dm: fix use-after-free in dm_put_live_table_bio
authorMikulas Patocka <mpatocka@redhat.com>
Thu, 16 Jun 2022 17:21:27 +0000 (13:21 -0400)
committerMike Snitzer <snitzer@kernel.org>
Thu, 16 Jun 2022 23:38:49 +0000 (19:38 -0400)
commit17a015ef0de190f5142d9582d8ed474110a2c359
treecd80ec66ee3d3574d43c72f77a5185ff85e366dd
parent67d4d63bc51138b599891e1f883f8d580e918d26
dm: fix use-after-free in dm_put_live_table_bio

dm_put_live_table_bio is called from the end of dm_submit_bio.
However, at this point, the bio may be already finished and the caller
may have freed the bio. Consequently, dm_put_live_table_bio accesses
the stale "bio" pointer.

Fix this bug by loading the bi_opf value and passing it to
dm_get_live_table_bio and dm_put_live_table_bio instead of the bio.

This bug was found by running the lvm2 testsuite with kasan.

Fixes: 7cb885820065 ("dm: introduce dm_{get,put}_live_table_bio called from dm_submit_bio")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
drivers/md/dm.c