diff options
| author | Darrick J. Wong <djwong@kernel.org> | 2023-11-22 21:47:10 +0300 |
|---|---|---|
| committer | Darrick J. Wong <djwong@kernel.org> | 2023-12-07 05:45:14 +0300 |
| commit | deb4cd8ba87f17b12c72b3827820d9c703e9fd95 (patch) | |
| tree | 98a85e6dca65337a4ce0ce7b9e30d71094cdda1a /fs/xfs/xfs_bmap_item.c | |
| parent | a050acdfa8003a44eae4558fddafc7afb1aef458 (diff) | |
| download | linux-deb4cd8ba87f17b12c72b3827820d9c703e9fd95.tar.xz | |
xfs: transfer recovered intent item ownership in ->iop_recover
Now that we pass the xfs_defer_pending object into the intent item
recovery functions, we know exactly when ownership of the sole refcount
passes from the recovery context to the intent done item. At that
point, we need to null out dfp_intent so that the recovery mechanism
won't release it. This should fix the UAF problem reported by Long Li.
Note that we still want to recreate the full deferred work state. That
will be addressed in the next patches.
Fixes: 2e76f188fd90 ("xfs: cancel intents immediately if process_intents fails")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Diffstat (limited to 'fs/xfs/xfs_bmap_item.c')
| -rw-r--r-- | fs/xfs/xfs_bmap_item.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c index 3ef55de370b5..b6d63b8bdad5 100644 --- a/fs/xfs/xfs_bmap_item.c +++ b/fs/xfs/xfs_bmap_item.c @@ -524,6 +524,8 @@ xfs_bui_item_recover( goto err_rele; budp = xfs_trans_get_bud(tp, buip); + xlog_recover_transfer_intent(tp, dfp); + xfs_ilock(ip, XFS_ILOCK_EXCL); xfs_trans_ijoin(tp, ip, 0); |