securityfs: fix use-after-free on symlink traversal
symlink body shouldn't be freed without an RCU delay. Switch securityfs to ->destroy_inode() and use of call_rcu(); free both the inode and symlink body in the callback. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
parent
6af1c849df
commit
46c8744196
|
@ -27,17 +27,22 @@
|
|||
static struct vfsmount *mount;
|
||||
static int mount_count;
|
||||
|
||||
static void securityfs_evict_inode(struct inode *inode)
|
||||
static void securityfs_i_callback(struct rcu_head *head)
|
||||
{
|
||||
truncate_inode_pages_final(&inode->i_data);
|
||||
clear_inode(inode);
|
||||
struct inode *inode = container_of(head, struct inode, i_rcu);
|
||||
if (S_ISLNK(inode->i_mode))
|
||||
kfree(inode->i_link);
|
||||
free_inode_nonrcu(inode);
|
||||
}
|
||||
|
||||
static void securityfs_destroy_inode(struct inode *inode)
|
||||
{
|
||||
call_rcu(&inode->i_rcu, securityfs_i_callback);
|
||||
}
|
||||
|
||||
static const struct super_operations securityfs_super_operations = {
|
||||
.statfs = simple_statfs,
|
||||
.evict_inode = securityfs_evict_inode,
|
||||
.destroy_inode = securityfs_destroy_inode,
|
||||
};
|
||||
|
||||
static int fill_super(struct super_block *sb, void *data, int silent)
|
||||
|
|
Loading…
Reference in New Issue