• Mikulas Patocka's avatar
    dm: fix use-after-free in dm_put_live_table_bio · 5d7362d0
    Mikulas Patocka authored
    dm_put_live_table_bio is called from the end of dm_submit_bio.
    However, at this point, the bio may be already finished and the caller
    may have freed the bio. Consequently, dm_put_live_table_bio accesses
    the stale "bio" pointer.
    
    Fix this bug by loading the bi_opf value and passing it to
    dm_get_live_table_bio and dm_put_live_table_bio instead of the bio.
    
    This bug was found by running the lvm2 testsuite with kasan.
    
    Fixes: 563a225c ("dm: introduce dm_{get,put}_live_table_bio called from dm_submit_bio")
    Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: default avatarMike Snitzer <snitzer@kernel.org>
    5d7362d0
dm.c 75.3 KB