dm: fix use-after-free in dm_put_live_table_bio
authorMikulas Patocka <mpatocka@redhat.com>
Thu, 16 Jun 2022 17:21:27 +0000 (13:21 -0400)
committerMike Snitzer <snitzer@kernel.org>
Thu, 16 Jun 2022 23:38:49 +0000 (19:38 -0400)
commit5d7362d0d56da3b85b19b5e5ce657026c2eef479
treecd80ec66ee3d3574d43c72f77a5185ff85e366dd
parent10eb3a0d517fcc83eeea4242c149461205675eb4
dm: fix use-after-free in dm_put_live_table_bio

dm_put_live_table_bio is called from the end of dm_submit_bio.
However, at this point, the bio may be already finished and the caller
may have freed the bio. Consequently, dm_put_live_table_bio accesses
the stale "bio" pointer.

Fix this bug by loading the bi_opf value and passing it to
dm_get_live_table_bio and dm_put_live_table_bio instead of the bio.

This bug was found by running the lvm2 testsuite with kasan.

Fixes: 563a225c9fd2 ("dm: introduce dm_{get,put}_live_table_bio called from dm_submit_bio")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
drivers/md/dm.c