Re: [PATCH] ext4: fix use-after-free in dx_release()

2019-05-08 Thread Sahitya Tummala
On Wed, May 08, 2019 at 01:09:47AM -0600, Andreas Dilger wrote: > On May 8, 2019, at 12:13 AM, Sahitya Tummala wrote: > > > > The buffer_head (frames[0].bh) and it's corresping page can be > > potentially free'd once brelse() is done inside the for loop > > but before the for loop exits in dx_rel

Re: [PATCH] ext4: fix use-after-free in dx_release()

2019-05-08 Thread Andreas Dilger
On May 8, 2019, at 12:13 AM, Sahitya Tummala wrote: > > The buffer_head (frames[0].bh) and it's corresping page can be > potentially free'd once brelse() is done inside the for loop > but before the for loop exits in dx_release(). It can be free'd > in another context, when the page cache is flus