Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f0112b64 authored by Al Viro's avatar Al Viro Committed by Greg Kroah-Hartman
Browse files

debugfs: fix use-after-free on symlink traversal 



[ Upstream commit 93b919da64c15b90953f96a536e5e61df896ca57 ]

symlink body shouldn't be freed without an RCU delay.  Switch debugfs to
->destroy_inode() and use of call_rcu(); free both the inode and symlink
body in the callback.  Similar to solution for bpf, only here it's even
more obvious that ->evict_inode() can be dropped.

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent e22c11da

fs/debugfs/inode.c

+9 −4
Original line number Diff line number Diff line
@@ -163,19 +163,24 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root) 
	return 0;

}



static void debugfs_evict_inode(struct inode *inode)

static void debugfs_i_callback(struct rcu_head *head)

{

	truncate_inode_pages_final(&inode->i_data);

	clear_inode(inode);

	struct inode *inode = container_of(head, struct inode, i_rcu);

	if (S_ISLNK(inode->i_mode))

		kfree(inode->i_link);

	free_inode_nonrcu(inode);

}



static void debugfs_destroy_inode(struct inode *inode)

{

	call_rcu(&inode->i_rcu, debugfs_i_callback);

}



static const struct super_operations debugfs_super_operations = {

	.statfs		= simple_statfs,

	.remount_fs	= debugfs_remount,

	.show_options	= debugfs_show_options,

	.evict_inode	= debugfs_evict_inode,

	.destroy_inode	= debugfs_destroy_inode,

};



static void debugfs_release_dentry(struct dentry *dentry)