On Tue, Jan 30, 2018 at 04:07:37PM +0200, Nikolay Borisov wrote: > Commit 4fde46f0cc71 ("Btrfs: free the stale device") introduced > btrfs_free_stale_device which iterates the device lists for all > registered btrfs filesystems and deletes those devices which aren't > mounted. In a btrfs_devices structure has only 1 device attached to it > and it is unused then btrfs_free_stale_devices will proceed to also > free the btrfs_fs_devices struct itself. Currently this leads to a UAF > since list_for_each_entry will try to perform a check on the already- > freed memory to see if it has to terminated the loop. > > The fix is to use 'break' when we know we are freeing the current > fs_devs. > > Fixes: 4fde46f0cc71 ("Btrfs: free the stale device") > Signed-off-by: Nikolay Borisov <nbori...@suse.com>
Added to next, thanks. -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html