From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Al Viro <viro@zeniv.linux.org.uk>,
Sasha Levin <sashal@kernel.org>,
linux-mtd@lists.infradead.org
Subject: [PATCH AUTOSEL 4.4 05/15] jffs2: fix use-after-free on symlink traversal
Date: Wed, 24 Apr 2019 10:51:42 -0400 [thread overview]
Message-ID: <20190424145152.31351-5-sashal@kernel.org> (raw)
In-Reply-To: <20190424145152.31351-1-sashal@kernel.org>
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 4fdcfab5b5537c21891e22e65996d4d0dd8ab4ca ]
free the symlink body after the same RCU delay we have for freeing the
struct inode itself, so that traversal during RCU pathwalk wouldn't step
into freed memory.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jffs2/readinode.c | 5 -----
fs/jffs2/super.c | 5 ++++-
2 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index bfebbf13698c..5b52ea41b84f 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -1414,11 +1414,6 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
- if (f->target) {
- kfree(f->target);
- f->target = NULL;
- }
-
fds = f->dents;
while(fds) {
fd = fds;
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 023e7f32ee1b..9fc297df8c75 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -47,7 +47,10 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb)
static void jffs2_i_callback(struct rcu_head *head)
{
struct inode *inode = container_of(head, struct inode, i_rcu);
- kmem_cache_free(jffs2_inode_cachep, JFFS2_INODE_INFO(inode));
+ struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+
+ kfree(f->target);
+ kmem_cache_free(jffs2_inode_cachep, f);
}
static void jffs2_destroy_inode(struct inode *inode)
--
2.19.1
next prev parent reply other threads:[~2019-04-24 14:54 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-24 14:51 [PATCH AUTOSEL 4.4 01/15] HID: debug: fix race condition with between rdesc_show() and device removal Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 02/15] rtc: sh: Fix invalid alarm warning for non-enabled alarm Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 03/15] igb: Fix WARN_ONCE on runtime suspend Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 04/15] bonding: show full hw address in sysfs for slave entries Sasha Levin
2019-04-24 14:51 ` Sasha Levin [this message]
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 06/15] debugfs: fix use-after-free on symlink traversal Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 07/15] rtc: da9063: set uie_unsupported when relevant Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 08/15] vfio/pci: use correct format characters Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 09/15] scsi: storvsc: Fix calculation of sub-channel count Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 10/15] net: hns: Use NAPI_POLL_WEIGHT for hns driver Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 11/15] net: hns: Fix WARNING when remove HNS driver with SMMU enabled Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 12/15] hugetlbfs: fix memory leak for resv_map Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 13/15] xsysace: Fix error handling in ace_setup Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 14/15] ARM: orion: don't use using 64-bit DMA masks Sasha Levin
2019-04-24 14:51 ` [PATCH AUTOSEL 4.4 15/15] ARM: iop: " Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190424145152.31351-5-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=stable@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).