public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

bcachefs: Fix lookup_inode_for_snapshot()

Browse source 
This fixes a use-after-free.

Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
This commit is contained in:
Kent Overstreet 2023-07-16 21:56:18 -04:00
parent 6b20d746ad
commit 20e6d9a8d4
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
fs/bcachefs/fsck.c
View file

@ -682,6 +682,7 @@ found:
if (snapshot != i->snapshot && !is_whiteout) { if (snapshot != i->snapshot && !is_whiteout) {
struct inode_walker_entry new = *i; struct inode_walker_entry new = *i;
size_t pos;
int ret; int ret;
new.snapshot = snapshot; new.snapshot = snapshot;
@ -693,9 +694,12 @@ found:
while (i > w->inodes.data && i[-1].snapshot > snapshot) while (i > w->inodes.data && i[-1].snapshot > snapshot)
--i; --i;
ret = darray_insert_item(&w->inodes, i - w->inodes.data, new); pos = i - w->inodes.data;
ret = darray_insert_item(&w->inodes, pos, new);
if (ret) if (ret)
return ERR_PTR(ret); return ERR_PTR(ret);
i = w->inodes.data + pos;
} }
return i; return i;