Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e22c11da authored by Al Viro's avatar Al Viro Committed by Greg Kroah-Hartman
Browse files

jffs2: fix use-after-free on symlink traversal 



[ Upstream commit 4fdcfab5b5537c21891e22e65996d4d0dd8ab4ca ]

free the symlink body after the same RCU delay we have for freeing the
struct inode itself, so that traversal during RCU pathwalk wouldn't step
into freed memory.

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 7cce2543

fs/jffs2/readinode.c

+0 −5
Original line number Diff line number Diff line
@@ -1414,11 +1414,6 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f) 


	jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);



	if (f->target) {

		kfree(f->target);

		f->target = NULL;

	}



	fds = f->dents;

	while(fds) {

		fd = fds;

fs/jffs2/super.c

+4 −1
Original line number Diff line number Diff line
@@ -47,7 +47,10 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb) 
static void jffs2_i_callback(struct rcu_head *head)

{

	struct inode *inode = container_of(head, struct inode, i_rcu);

	kmem_cache_free(jffs2_inode_cachep, JFFS2_INODE_INFO(inode));

	struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);



	kfree(f->target);

	kmem_cache_free(jffs2_inode_cachep, f);

}



static void jffs2_destroy_inode(struct inode *inode)