debugfs: fix use-after-free on symlink traversal
mainline inclusion from mainline-5.1-rc4 commit 93b919da category: bugfix bugzilla: 13537 CVE: NA ------------------------------------------------- symlink body shouldn't be freed without an RCU delay. Switch debugfs to ->destroy_inode() and use of call_rcu(); free both the inode and symlink body in the callback. Similar to solution for bpf, only here it's even more obvious that ->evict_inode() can be dropped. Signed-off-by:Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
zhangyi (F) <yi.zhang@huawei.com> Reviewed-by:
Yufen Yu <yuyufen@huawei.com> Signed-off-by:
Yang Yingliang <yangyingliang@huawei.com>
Loading
Please sign in to comment