| Description: | In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in
nilfs_gccache_submit_read_data() In nilfs_gccache_submit_read_data(),
brelse(bh) is called to drop the reference count of bh when the call
to nilfs_dat_translate() fails. If the reference count hits 0 and its
owner page gets unlocked, bh may be freed. However, bh->b_page is
dereferenced to put the page after that, which may result in a use-
after-free bug. This patch moves the release operation after unlocking
and putting the page. NOTE: The function in question is only called in
GC, and in combination with current userland tools, address
translation using DAT does not occur in that function, so the code
path that causes this issue will not be executed. However, it is
possible to run that code path by intentionally modifying the userland
GC library or by calling the GC ioctl directly.
[konishi.ryusuke@gmail.com: NOTE added to the commit log]
|
