Skip to content
Commit e0e1958f authored by Edward Adam Davis's avatar Edward Adam Davis Committed by Dave Kleikamp
Browse files

jfs: fix uaf in jfs_evict_inode



When the execution of diMount(ipimap) fails, the object ipimap that has been
released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs
when rcu_core() calls jfs_free_node().

Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as
ipimap.

Reported-and-tested-by: default avatar <syzbot+01cf2dbcbe2022454388@syzkaller.appspotmail.com>
Signed-off-by: default avatarEdward Adam Davis <eadavis@qq.com>
Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
parent 74ecdda6
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment