releases/4.19.46/securityfs-fix-use-after-free-on-symlink-traversal.patch

   1 From 13a25e5d57e08e09afcfb7854a984bf4aa567363 Mon Sep 17 00:00:00 2001
   2 From: Al Viro <viro@zeniv.linux.org.uk>
   3 Date: Wed, 10 Apr 2019 14:03:45 -0400
   4 Subject: securityfs: fix use-after-free on symlink traversal
   5
   6 [ Upstream commit 46c874419652bbefdfed17420fd6e88d8a31d9ec ]
   7
   8 symlink body shouldn't be freed without an RCU delay.  Switch securityfs
   9 to ->destroy_inode() and use of call_rcu(); free both the inode and symlink
  10 body in the callback.
  11
  12 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  13 Signed-off-by: Sasha Levin <sashal@kernel.org>
  14 ---
  15  security/inode.c | 13 +++++++++----
  16  1 file changed, 9 insertions(+), 4 deletions(-)
  17
  18 diff --git a/security/inode.c b/security/inode.c
  19 index 8dd9ca8848e43..829f15672e01f 100644
  20 --- a/security/inode.c
  21 +++ b/security/inode.c
  22 @@ -26,17 +26,22 @@
  23  static struct vfsmount *mount;
  24  static int mount_count;
  25
  26 -static void securityfs_evict_inode(struct inode *inode)
  27 +static void securityfs_i_callback(struct rcu_head *head)
  28  {
  29 -       truncate_inode_pages_final(&inode->i_data);
  30 -       clear_inode(inode);
  31 +       struct inode *inode = container_of(head, struct inode, i_rcu);
  32         if (S_ISLNK(inode->i_mode))
  33                 kfree(inode->i_link);
  34 +       free_inode_nonrcu(inode);
  35 +}
  36 +
  37 +static void securityfs_destroy_inode(struct inode *inode)
  38 +{
  39 +       call_rcu(&inode->i_rcu, securityfs_i_callback);
  40  }
  41
  42  static const struct super_operations securityfs_super_operations = {
  43         .statfs         = simple_statfs,
  44 -       .evict_inode    = securityfs_evict_inode,
  45 +       .destroy_inode  = securityfs_destroy_inode,
  46  };
  47
  48  static int fill_super(struct super_block *sb, void *data, int silent)
  49 --
  50 2.20.1
  51