]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
projects / thirdparty / kernel / stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 0cdc17e) | patch
debugfs: fix use-after-free on symlink traversal
authorAl Viro <viro@zeniv.linux.org.uk>
Tue, 26 Mar 2019 01:43:37 +0000 (01:43 +0000)
committerAl Viro <viro@zeniv.linux.org.uk>
Mon, 1 Apr 2019 04:31:02 +0000 (00:31 -0400)
commit93b919da64c15b90953f96a536e5e61df896ca57
tree61aa43c048da6f2f480bd999cd9835cf3ef47d9dtree | snapshot
parent0cdc17ebd2072b6cdd3ec3695ea7ede745664a8bcommit | diff
debugfs: fix use-after-free on symlink traversal

symlink body shouldn't be freed without an RCU delay.  Switch debugfs to
->destroy_inode() and use of call_rcu(); free both the inode and symlink
body in the callback.  Similar to solution for bpf, only here it's even
more obvious that ->evict_inode() can be dropped.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/debugfs/inode.c diff | blob | blame | history
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git