1. 27 Feb, 2019 1 commit
    • Gao Xiang's avatar
      staging: erofs: compressed_pages should not be accessed again after freed · af692e11
      Gao Xiang authored
      This patch resolves the following page use-after-free issue,
      z_erofs_vle_unzip:
          ...
          for (i = 0; i < nr_pages; ++i) {
              ...
              z_erofs_onlinepage_endio(page);  (1)
          }
      
          for (i = 0; i < clusterpages; ++i) {
              page = compressed_pages[i];
      
              if (page->mapping == mngda)      (2)
                  continue;
              /* recycle all individual staging pages */
              (void)z_erofs_gather_if_stagingpage(page_pool, page); (3)
              WRITE_ONCE(compressed_pages[i], NULL);
          }
          ...
      
      After (1) is executed, page is freed and could be then reused, if
      compressed_pages is scanned after that, it could fall info (2) or
      (3) by mistake and that could finally be in a mess.
      
      This patch aims to solve the above issue only with little changes
      as much as possible in order to make the fix backport easier.
      
      Fixes: 3883a79a ("staging: erofs: introduce VLE decompression support")
      Cc: <stable@vger.kernel.org> # 4.19+
      Signed-off-by: default avatarGao Xiang <gaoxiang25@huawei.com>
      Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      af692e11
  2. 26 Feb, 2019 27 commits
  3. 21 Feb, 2019 3 commits
  4. 20 Feb, 2019 2 commits
  5. 19 Feb, 2019 7 commits