Skip to main content

Browse the archive

https://github.com/torvalds/linux
23 October 2021, 00:29:24 UTC
Revision 43385846968b082bb6c174e8b17479e5123b8d73 authored by David Rientjes on 18 October 2012, 03:41:15 UTC, committed by Linus Torvalds on 18 October 2012, 19:35:58 UTC 
fs, xattr: fix bug when removing a name not in xattr list
 
Commit 38f38657444d ("xattr: extract simple_xattr code from tmpfs") moved
some code from tmpfs but introduced a subtle bug along the way.

If the name passed to simple_xattr_remove() does not exist in the list of
xattrs, then it is possible to call kfree(new_xattr) when new_xattr is
actually initialized to itself on the stack via uninitialized_var().

This causes a BUG() since the memory was not allocated via the slab
allocator and was not bypassed through to the page allocator because it
was too large.

Initialize the local variable to NULL so the kfree() never takes place.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: David Rientjes <rientjes@google.com>
Acked-by: Hugh Dickins <hughd@google.com>
Acked-by: Aristeu Rozanski <aris@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent d63e210
History
Tip revision: 43385846968b082bb6c174e8b17479e5123b8d73 authored by David Rientjes on 18 October 2012, 03:41:15 UTC
fs, xattr: fix bug when removing a name not in xattr list
Tip revision: 4338584
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 1.2 KB
.mailmap -rw-r--r-- 4.4 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 92.7 KB
Kbuild -rw-r--r-- 2.5 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 222.2 KB
Makefile -rw-r--r-- 46.4 KB
README -rw-r--r-- 18.2 KB
REPORTING-BUGS -rw-r--r-- 3.3 KB

README

back to top