ext4: do not use extent after put_bh
authoryangerkun <yangerkun@huawei.com>
Wed, 28 Oct 2020 05:56:17 +0000 (13:56 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 5 Nov 2020 10:51:52 +0000 (11:51 +0100)
commitcef20b45c9024fe43e9bc3a25f557d99f68d5d1a
tree9e029ab8855286faf2dfba9c8b8e801ad8e0bbc9
parent7bb9a23986895a373b7e1fcbfeeb9a1c954c4da3
ext4: do not use extent after put_bh

commit d7dce9e08595e80bf8039a81794809c66fe26431 upstream.

ext4_ext_search_right() will read more extent blocks and call put_bh
after we get the information we need.  However, ret_ex will break this
and may cause use-after-free once pagecache has been freed.  Fix it by
copying the extent structure if needed.

Signed-off-by: yangerkun <yangerkun@huawei.com>
Link: https://lore.kernel.org/r/20201028055617.2569255-1-yangerkun@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/ext4/extents.c