Re: [PATCH v2] ext4: fix use-after-free in dx_release()

2019-05-11 Thread Theodore Ts'o
On Wed, May 08, 2019 at 02:04:03PM +0530, Sahitya Tummala wrote: > The buffer_head (frames[0].bh) and it's corresping page can be > potentially free'd once brelse() is done inside the for loop > but before the for loop exits in dx_release(). It can be free'd > in another context, when the page cach

Re: [PATCH v2] ext4: fix use-after-free in dx_release()

2019-05-08 Thread Andreas Dilger
On May 8, 2019, at 2:34 AM, Sahitya Tummala wrote: > > The buffer_head (frames[0].bh) and it's corresping page can be > potentially free'd once brelse() is done inside the for loop > but before the for loop exits in dx_release(). It can be free'd > in another context, when the page cache is flush

[PATCH v2] ext4: fix use-after-free in dx_release()

2019-05-08 Thread Sahitya Tummala
The buffer_head (frames[0].bh) and it's corresping page can be potentially free'd once brelse() is done inside the for loop but before the for loop exits in dx_release(). It can be free'd in another context, when the page cache is flushed via drop_caches_sysctl_handler(). This results into below da