]> git.baikalelectronics.ru Git - kernel.git/commit
dm: fix use-after-free in dm_put_live_table_bio
authorMikulas Patocka <mpatocka@redhat.com>
Thu, 16 Jun 2022 17:21:27 +0000 (13:21 -0400)
committerMike Snitzer <snitzer@kernel.org>
Thu, 16 Jun 2022 23:38:49 +0000 (19:38 -0400)
commit9b7df00d60b16ff795ec363a327d2440211df037
treecd80ec66ee3d3574d43c72f77a5185ff85e366dd
parent24a26fea50e205b022886630990e2587f96b3c75
dm: fix use-after-free in dm_put_live_table_bio

dm_put_live_table_bio is called from the end of dm_submit_bio.
However, at this point, the bio may be already finished and the caller
may have freed the bio. Consequently, dm_put_live_table_bio accesses
the stale "bio" pointer.

Fix this bug by loading the bi_opf value and passing it to
dm_get_live_table_bio and dm_put_live_table_bio instead of the bio.

This bug was found by running the lvm2 testsuite with kasan.

Fixes: efccf0add9b1 ("dm: introduce dm_{get,put}_live_table_bio called from dm_submit_bio")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
drivers/md/dm.c