Pan Bian 164f7e5867 ocfs2: fix potential use after free ...

ocfs2_get_dentry() calls iput(inode) to drop the reference count of
inode, and if the reference count hits 0, inode is freed.  However, in
this function, it then reads inode->i_generation, which may result in a
use after free bug.  Move the put operation later.

Link: http://lkml.kernel.org/r/1543109237-110227-1-git-send-email-bianpan2016@163.com
Fixes: 781f200cb7a("ocfs2: Remove masklog ML_EXPORT.")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Changwei Ge <ge.changwei@h3c.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2018-11-30 14:56:15 -08:00

..

cluster

ocfs2: free up write context when direct IO failed

2018-11-18 10:15:09 -08:00

dlm

fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in dlm_print_one_mle()

2018-10-26 16:25:18 -07:00

dlmfs

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

acl.c

ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute

2018-01-31 17:18:35 -08:00

acl.h

…

alloc.c

ocfs2: remove unused pointer 'eb'

2018-10-26 16:25:18 -07:00

alloc.h

ocfs2: try to reuse extent block in dealloc without meta_alloc

2018-01-31 17:18:35 -08:00

aops.c

ocfs2: free up write context when direct IO failed

2018-11-18 10:15:09 -08:00

aops.h

ocfs2: keep the trace point consistent with the function name

2018-04-05 21:36:21 -07:00

blockcheck.c

…

blockcheck.h

…

buffer_head_io.c

ocfs2: don't put and assigning null to bh allocated outside

2018-11-03 10:09:37 -07:00

buffer_head_io.h

ocfs2: clean up some unused function declarations

2017-11-15 18:21:01 -08:00

dcache.c

…

dcache.h

…

dir.c

ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry

2018-11-03 10:09:37 -07:00

dir.h

…

dlmglue.c

ocfs2: dlmglue: clean up timestamp handling

2018-11-03 10:09:37 -07:00

dlmglue.h

ocfs2: ocfs2_inode_lock_tracker does not distinguish lock level

2018-06-07 17:34:33 -07:00

export.c

ocfs2: fix potential use after free

2018-11-30 14:56:15 -08:00

export.h

…

extent_map.c

ocfs2: add ocfs2_overwrite_io()

2018-01-31 17:18:35 -08:00

extent_map.h

ocfs2: add ocfs2_overwrite_io()

2018-01-31 17:18:35 -08:00

file.c

ocfs2: don't use iocb when EIOCBQUEUED returns

2018-11-03 10:09:37 -07:00

file.h

ocfs2: clean up redundant function declarations

2018-06-07 17:34:33 -07:00

filecheck.c

ocfs2: add duplicated ino number check

2018-04-05 21:36:22 -07:00

filecheck.h

ocfs2: add kobject for online file check

2018-04-05 21:36:22 -07:00

heartbeat.c

…

heartbeat.h

…

inode.c

ocfs2: clean up some unnecessary code

2018-08-17 16:20:27 -07:00

inode.h

…

ioctl.c

ocfs2: eliminate a misreported warning

2018-06-07 17:34:33 -07:00

ioctl.h

…

journal.c

ocfs2: without quota support, avoid calling quota recovery

2018-11-03 10:09:37 -07:00

journal.h

…

Kconfig

…

localalloc.c

ocfs2: return -EROFS when filesystem becomes read-only

2018-08-17 16:20:27 -07:00

localalloc.h

…

locks.c

…

locks.h

…

Makefile

…

mmap.c

fs: ocfs2: use new return type vm_fault_t

2018-06-07 17:34:34 -07:00

mmap.h

…

move_extents.c

ocfs2: fix deadlock caused by ocfs2_defrag_extent()

2018-11-30 14:56:13 -08:00

move_extents.h

…

namei.c

ocfs2: drop a VLA in ocfs2_orphan_del()

2018-06-07 17:34:34 -07:00

namei.h

…

ocfs1_fs_compat.h

…

ocfs2_fs.h

ocfs2: correct the comments position of struct ocfs2_dir_block_trailer

2018-06-07 17:34:34 -07:00

ocfs2_ioctl.h

…

ocfs2_lockid.h

ocfs2: add trimfs dlm lock resource

2018-01-31 17:18:35 -08:00

ocfs2_lockingver.h

…

ocfs2_trace.h

ocfs2: keep the trace point consistent with the function name

2018-04-05 21:36:21 -07:00

ocfs2.h

ocfs2: add kobject for online file check

2018-04-05 21:36:22 -07:00

quota_global.c

ocfs2: convert to new i_version API

2018-01-29 06:42:21 -05:00

quota_local.c

ocfs2: return -EROFS when filesystem becomes read-only

2018-08-17 16:20:27 -07:00

quota.h

…

refcounttree.c

Merge tag 'xfs-4.20-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

2018-11-02 09:33:08 -07:00

refcounttree.h

ocfs2: remove ocfs2_reflink_remap_range

2018-10-30 10:45:48 +11:00

reservations.c

…

reservations.h

…

resize.c

…

resize.h

…

slot_map.c

…

slot_map.h

…

stack_o2cb.c

…

stack_user.c

treewide: Align function definition open/close braces

2018-03-26 11:13:09 +02:00

stackglue.c

ocfs2: remove ocfs2_is_o2cb_active()

2018-11-03 10:09:37 -07:00

stackglue.h

ocfs2: remove ocfs2_is_o2cb_active()

2018-11-03 10:09:37 -07:00

suballoc.c

ocfs2: remove two unused functions from suballoc.c

2018-04-05 21:36:22 -07:00

suballoc.h

…

super.c

ocfs2: add kobject for online file check

2018-04-05 21:36:22 -07:00

super.h

ocfs2: remove unused declaration ocfs2_publish_get_mount_state()

2017-11-15 18:21:01 -08:00

symlink.c

…

symlink.h

…

sysfile.c

treewide: kzalloc() -> kcalloc()

2018-06-12 16:19:22 -07:00

sysfile.h

…

uptodate.c

ocfs2: remove unnecessary null pointer check before kmem_cache_destroy()

2018-04-05 21:36:22 -07:00

uptodate.h

…

xattr.c

ocfs2: use 'osb' instead of 'OCFS2_SB()'

2018-04-05 21:36:21 -07:00

xattr.h

…