]> git.ipfire.org Git - people/ms/linux.git/commit - fs/ext4/ext4.h
projects / people / ms / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 6fd9417) | patch
ext4: fix use-after-free race in ext4_remount()'s error path
authorTheodore Ts'o <tytso@mit.edu>
Fri, 12 Oct 2018 13:28:09 +0000 (09:28 -0400)
committerTheodore Ts'o <tytso@mit.edu>
Fri, 12 Oct 2018 13:28:09 +0000 (09:28 -0400)
commit33458eaba4dfe778a426df6a19b7aad2ff9f7eec
treef4732bd54c93bd877209855b3148db771da85b55tree | snapshot
parent6fd941784b8ac3e74313f7112f0586076dc36544commit | diff
ext4: fix use-after-free race in ext4_remount()'s error path

It's possible for ext4_show_quota_options() to try reading
s_qf_names[i] while it is being modified by ext4_remount() --- most
notably, in ext4_remount's error path when the original values of the
quota file name gets restored.

Reported-by: syzbot+a2872d6feea6918008a9@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 3.2+
fs/ext4/ext4.h diff | blob | blame | history
fs/ext4/super.c diff | blob | blame | history
Michael's Linux tree.