diff options
| author | Darrick J. Wong <djwong@kernel.org> | 2026-01-23 09:27:39 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-02-16 10:18:45 +0100 |
| commit | 1d411278dda293a507cb794db7d9ed3511c685c6 (patch) | |
| tree | a337696c618dcb82d61a2975713e2ea7db008907 /include/net/aligned_data.h | |
| parent | ae385826840a3c8e09bf38cac90adcd690716f57 (diff) | |
xfs: fix UAF in xchk_btree_check_block_owner
commit 1c253e11225bc5167217897885b85093e17c2217 upstream.
We cannot dereference bs->cur when trying to determine if bs->cur
aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed.
Fix this by sampling before type before any freeing could happen.
The correct temporal ordering was broken when we removed xfs_btnum_t.
Cc: r772577952@gmail.com
Cc: <stable@vger.kernel.org> # v6.9
Fixes: ec793e690f801d ("xfs: remove xfs_btnum_t")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jiaming Zhang <r772577952@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/net/aligned_data.h')
0 files changed, 0 insertions, 0 deletions