• Lachlan McIlroy's avatar
    [XFS] Fix use-after-free with buffers · e1f5dbd7
    Lachlan McIlroy authored
    We have a use-after-free issue where log completions access buffers via
    the buffer log item and the buffer has already been freed. Fix this by
    taking a reference on the buffer when attaching the buffer log item and
    release the hold when the buffer log item is detached and we no longer
    need the buffer. Also create a new function xfs_buf_item_free() to combine
    some common code.
    SGI-PV: 985757
    SGI-Modid: xfs-linux-melb:xfs-kern:32025a
    Signed-off-by: default avatarLachlan McIlroy <lachlan@sgi.com>
    Signed-off-by: default avatarChristoph Hellwig <hch@infradead.org>
xfs_buf_item.c 31.9 KB