Bug 458755

Summary: kernel: dlm: fix possible use-after-free [mrg-1]
Product: Red Hat Enterprise MRG Reporter: Eugene Teo (Security Response) <eteo>
Component: realtime-kernelAssignee: Red Hat Real Time Maintenance <rt-maint>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 1.1CC: bhu, davids, eteo, lgoncalv, williams
Target Milestone: 1.0.3   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-10-07 19:20:53 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Upstream patch for this issue none

Description Eugene Teo (Security Response) 2008-08-12 04:01:56 UTC
Description of problem:
The dlm_put_lkb() can free the lkb and its associated ua structure, so we can't depend on using the ua struct after the put.

Comment 2 Eugene Teo (Security Response) 2008-08-12 04:06:19 UTC
Created attachment 314041 [details]
Upstream patch for this issue

Comment 3 Beth Uptagrafft 2008-09-05 18:32:28 UTC
in -77

Comment 5 David Sommerseth 2008-09-23 11:37:10 UTC
Verified that upstream commit ce5246b972f7514af899a63c0faf831d05ed5ee1 is implemented in the mrg-rt-2.6.24-81 code.  (mrg-rt commit e7d3f287ddc307fb78b15dd7d2ef3a6a77e29bbc)

Comment 7 errata-xmlrpc 2008-10-07 19:20:53 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2008-0857.html