From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A07C2CCF9FD for ; Wed, 6 Sep 2023 01:42:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235274AbjIFBmi (ORCPT ); Tue, 5 Sep 2023 21:42:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50242 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229806AbjIFBmg (ORCPT ); Tue, 5 Sep 2023 21:42:36 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4CE3C1B3 for ; Tue, 5 Sep 2023 18:42:32 -0700 (PDT) Received: from kwepemm600013.china.huawei.com (unknown [172.30.72.57]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4RgQ4k1j8MztQSC; Wed, 6 Sep 2023 09:38:30 +0800 (CST) Received: from [10.174.178.46] (10.174.178.46) by kwepemm600013.china.huawei.com (7.193.23.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Wed, 6 Sep 2023 09:42:28 +0800 Subject: Re: [PATCH] ubifs: fix possible dereference after free To: Konstantin Meskhidze , CC: , , , References: <20230905101222.1725230-1-konstantin.meskhidze@huawei.com> From: Zhihao Cheng Message-ID: <939c0385-8663-91a2-df20-920f264a2aa1@huawei.com> Date: Wed, 6 Sep 2023 09:42:27 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.5.0 MIME-Version: 1.0 In-Reply-To: <20230905101222.1725230-1-konstantin.meskhidze@huawei.com> Content-Type: text/plain; charset="gbk"; format=flowed Content-Transfer-Encoding: 8bit X-Originating-IP: [10.174.178.46] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To kwepemm600013.china.huawei.com (7.193.23.68) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ÔÚ 2023/9/5 18:12, Konstantin Meskhidze дµÀ: > 'old_idx' could be dereferenced after free via 'rb_link_node' function > call. > > Fixes: b5fda08ef213 ("ubifs: Fix memleak when insert_old_idx() failed") > Co-developed-by: Ivanov Mikhail > Signed-off-by: Konstantin Meskhidze > --- > fs/ubifs/tnc.c | 1 + > 1 file changed, 1 insertion(+) > Only for static alarms£¬although it couldn't happen in theory. Reviewed-by: Zhihao Cheng > diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c > index 6b7d95b65f4b..f4728e65d1bd 100644 > --- a/fs/ubifs/tnc.c > +++ b/fs/ubifs/tnc.c > @@ -64,8 +64,9 @@ static void do_insert_old_idx(struct ubifs_info *c, > p = &(*p)->rb_right; > else { > ubifs_err(c, "old idx added twice!"); > kfree(old_idx); > + return; > } > } > rb_link_node(&old_idx->rb, parent, p); > rb_insert_color(&old_idx->rb, &c->old_idx); >