mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 22:02:02 +00:00
securityfs: fix use-after-free on symlink traversal
[ Upstream commit 46c8744196
]
symlink body shouldn't be freed without an RCU delay. Switch securityfs
to ->destroy_inode() and use of call_rcu(); free both the inode and symlink
body in the callback.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
900bf351dd
commit
9a0467e1f6
1 changed files with 9 additions and 4 deletions
|
@ -26,17 +26,22 @@
|
|||
static struct vfsmount *mount;
|
||||
static int mount_count;
|
||||
|
||||
static void securityfs_evict_inode(struct inode *inode)
|
||||
static void securityfs_i_callback(struct rcu_head *head)
|
||||
{
|
||||
truncate_inode_pages_final(&inode->i_data);
|
||||
clear_inode(inode);
|
||||
struct inode *inode = container_of(head, struct inode, i_rcu);
|
||||
if (S_ISLNK(inode->i_mode))
|
||||
kfree(inode->i_link);
|
||||
free_inode_nonrcu(inode);
|
||||
}
|
||||
|
||||
static void securityfs_destroy_inode(struct inode *inode)
|
||||
{
|
||||
call_rcu(&inode->i_rcu, securityfs_i_callback);
|
||||
}
|
||||
|
||||
static const struct super_operations securityfs_super_operations = {
|
||||
.statfs = simple_statfs,
|
||||
.evict_inode = securityfs_evict_inode,
|
||||
.destroy_inode = securityfs_destroy_inode,
|
||||
};
|
||||
|
||||
static int fill_super(struct super_block *sb, void *data, int silent)
|
||||
|
|
Loading…
Reference in a new issue