In the Linux kernel, the following vulnerability has been resolved:
ext4: avoid use-after-free in ext4extshow_leaf()
In ext4findextent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows:
ext4splitextent path = *ppath; ext4splitextentat(ppath) path = ext4findextent(ppath) ext4splitextentat(ppath) // ext4findextent fails to free path // but zeroout succeeds ext4extshowleaf(inode, path) eh = path[depth].phdr // path use-after-free !!!
Similar to ext4splitextentat(), we use *ppath directly as an input to ext4extshowleaf(). Fix a spelling error by the way.
Same problem in ext4exthandleunwrittenextents(). Since 'path' is only used in ext4extshow_leaf(), remove 'path' and use *ppath directly.
This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality.