redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

configs fix for 5.2 

- fix a use after free in configfs_d_iput (Sahitya Tummala)
 -----BEGIN PGP SIGNATURE-----
 
 iQI/BAABCgApFiEEgdbnc3r/njty3Iq9D55TZVIEUYMFAlzvmYQLHGhjaEBsc3Qu
 ZGUACgkQD55TZVIEUYPz/A/+JH4Z1nKUNPFPtRIKkFf/3sBrMjBvw+feV7a2AiDS
 SbwNu7Rv30VjQYe6ABmANz6B0me6Zr2ELEn7v0x4tXNXXqBUVOLc88Sq8WyIq26V
 6GkZJ+8OvLxdamZCSFITZy/XgIzZFBBNeSDg7NIZU1kEUSGwsS5HhQlUzoLD3sFI
 8dguMEDGRypSV4cFu87q2NjA6r7ti35Rn/VZeS7Zkwopv6yc6xo9g4ocfvcuZcuK
 lI7ZW6aKzLfPel13qyqUFklG4sZ/U+uffjs5zJHGbA1Doe7g6ulHWFaM9rW8b6oB
 3XZ/s47uAtcDdIqH59Snk3aHmkk1pwBlxLJcpdrBskxeXFoC5UrQIDWE43WZ8xvK
 VZr4Nk+SmkTYG6t9aETplV15FP3BVZXdjVKVKWqhHDzRV3SkX+VfDfsG31P/Kicw
 Dl/1sokt7tdoCjXMiPILGtajacpspgMlpL2ztQG5DojsTtKRUd/wm6PhDVNYusHH
 GkL1JBqEzVkhZalVapGWRT9DxZGIu6nhF+E7lvhdExFU/yZsXTIlI8suNM8jKoLM
 P4mTb5bTwfjjUj2Z3KxzyIc5Kg4SHjjpzY2E6Fb/mY3BpzURzc2qHm9+f2k5/Xsq
 OlwPNwC0Br4W6NkNrlUmh8VUk3zAL3V5TwNz21uyyg4PgKL3a0yexSkOsR2TSnL8
 c/k=
 =qQ2a
 -----END PGP SIGNATURE-----

Merge tag 'configfs-for-5.2-2' of git://git.infradead.org/users/hch/configfs

Pull configs fix from Christoph Hellwig:

 - fix a use after free in configfs_d_iput (Sahitya Tummala)

* tag 'configfs-for-5.2-2' of git://git.infradead.org/users/hch/configfs:
  configfs: Fix use-after-free when accessing sd->s_dentry
hifive-unleashed-5.2
Linus Torvalds 2019-05-30 20:35:48 -07:00
parent c5ba171266 f6122ed2a4
commit 8cb7104d03
1 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
fs/configfs/dir.c
View File

@ -58,15 +58,13 @@ static void configfs_d_iput(struct dentry * dentry,
if (sd) {
/* Coordinate with configfs_readdir */
spin_lock(&configfs_dirent_lock);
/* Coordinate with configfs_attach_attr where will increase
* sd->s_count and update sd->s_dentry to new allocated one.
* Only set sd->dentry to null when this dentry is the only
* sd owner.
* If not do so, configfs_d_iput may run just after
* configfs_attach_attr and set sd->s_dentry to null
* even it's still in use.
/*
* Set sd->s_dentry to null only when this dentry is the one
* that is going to be killed. Otherwise configfs_d_iput may
* run just after configfs_attach_attr and set sd->s_dentry to
* NULL even it's still in use.
*/
if (atomic_read(&sd->s_count) <= 2)
if (sd->s_dentry == dentry)
sd->s_dentry = NULL;
spin_unlock(&configfs_dirent_lock);