Re: [PATCH] lightnvm: pblk: fix use-after-free bug

[Gustavo A. R. Silva]

On 12/22/18 12:30 PM, Matias BjÃrling wrote:
> On 12/22/18 8:39 AM, Gustavo A. R. Silva wrote:
> > Remove one of the calls to function bio_put(), so *bio* is only
> > freed once.
> >
> > Notice that bio is being dereferenced in bio_put(), hence leading to
> > a use-after-free bug once *bio* has already been freed.
> >
> > Addresses-Coverity-ID: 1475952 ("Use after free")
> > Fixes: 55d8ec35398e ("lightnvm: pblk: support packed metadata")
> > Signed-off-by: Gustavo A. R. Silva <gustavo@xxxxxxxxxxxxxx>
> > ---
> > Â drivers/lightnvm/pblk-recovery.c | 1 -
> > Â 1 file changed, 1 deletion(-)
> >
> > diff --git a/drivers/lightnvm/pblk-recovery.c 
> > b/drivers/lightnvm/pblk-recovery.c
> > index 3fcf062d752c..5ee20da7bdb3 100644
> > --- a/drivers/lightnvm/pblk-recovery.c
> > +++ b/drivers/lightnvm/pblk-recovery.c
> > @@ -418,7 +418,6 @@ static int pblk_recov_scan_oob(struct pblk *pblk, 
> > struct pblk_line *line,
> > ÂÂÂÂÂ if (ret) {
> > ÂÂÂÂÂÂÂÂÂ pblk_err(pblk, "I/O submission failed: %d\n", ret);
> > ÂÂÂÂÂÂÂÂÂ bio_put(bio);
> > -ÂÂÂÂÂÂÂ bio_put(bio);
> > ÂÂÂÂÂÂÂÂÂ return ret;
> > ÂÂÂÂÂ }
>
> Thanks Gustavo. I missed that one.
>
> Jens, if possible could you please pick this up?
>
> Happy holidays!

Glad to help. :)

Happy holidays everybody.

--
Gustavo