Commit 4fdcfab5 authored by Al Viro's avatar Al Viro
Browse files

jffs2: fix use-after-free on symlink traversal 



free the symlink body after the same RCU delay we have for freeing the
struct inode itself, so that traversal during RCU pathwalk wouldn't step
into freed memory.

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 9e98c678

fs/jffs2/readinode.c

+0 −5
Original line number Diff line number Diff line
@@ -1414,11 +1414,6 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f) 


	jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);



	if (f->target) {

		kfree(f->target);

		f->target = NULL;

	}



	fds = f->dents;

	while(fds) {

		fd = fds;

fs/jffs2/super.c

+4 −1
Original line number Diff line number Diff line
@@ -47,7 +47,10 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb) 
static void jffs2_i_callback(struct rcu_head *head)

{

	struct inode *inode = container_of(head, struct inode, i_rcu);

	kmem_cache_free(jffs2_inode_cachep, JFFS2_INODE_INFO(inode));

	struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);



	kfree(f->target);

	kmem_cache_free(jffs2_inode_cachep, f);

}



static void jffs2_destroy_inode(struct inode *inode)