git.codelabs.ch / muen / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 0cdc17e) | patch
debugfs: fix use-after-free on symlink traversal
authorAl Viro <viro@zeniv.linux.org.uk>
Tue, 26 Mar 2019 01:43:37 +0000 (01:43 +0000)
committerAl Viro <viro@zeniv.linux.org.uk>
Mon, 1 Apr 2019 04:31:02 +0000 (00:31 -0400)
commit93b919da64c15b90953f96a536e5e61df896ca57
tree61aa43c048da6f2f480bd999cd9835cf3ef47d9dtree | snapshot (tar.gz zip)
parent0cdc17ebd2072b6cdd3ec3695ea7ede745664a8bcommit | diff
debugfs: fix use-after-free on symlink traversal

symlink body shouldn't be freed without an RCU delay.  Switch debugfs to
->destroy_inode() and use of call_rcu(); free both the inode and symlink
body in the callback.  Similar to solution for bpf, only here it's even
more obvious that ->evict_inode() can be dropped.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/debugfs/inode.c diff | blob | history
Linux kernel with Muen SK support