summaryrefslogtreecommitdiff
path: root/drivers/md
diff options
context:
space:
mode:
authorJens Axboe <axboe@kernel.dk>2024-04-09 06:49:27 +0300
committerJens Axboe <axboe@kernel.dk>2024-04-09 06:49:27 +0300
commit013ee5a6234d4c574dedd60c4887a4bcc9ecc749 (patch)
tree7d3f5ac01441d0c1bf08a50efd34a8ef37fee73e /drivers/md
parentb561ea56a26415bf44ce8ca6a8e625c7c390f1ea (diff)
parentfcf3f7e2fc8a53a6140beee46ec782a4c88e4744 (diff)
downloadlinux-013ee5a6234d4c574dedd60c4887a4bcc9ecc749.tar.xz
Merge tag 'md-6.9-20240408' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.9
Pull MD fix from Song: "This change, by Yu Kuai, fixes a UAF in a corner case." * tag 'md-6.9-20240408' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: raid1: fix use-after-free for original bio in raid1_write_request()
Diffstat (limited to 'drivers/md')
-rw-r--r--drivers/md/raid1.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index be8ac24f50b6..7b8a71ca66dd 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1558,7 +1558,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
for (j = 0; j < i; j++)
if (r1_bio->bios[j])
rdev_dec_pending(conf->mirrors[j].rdev, mddev);
- free_r1bio(r1_bio);
+ mempool_free(r1_bio, &conf->r1bio_pool);
allow_barrier(conf, bio->bi_iter.bi_sector);
if (bio->bi_opf & REQ_NOWAIT) {