diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2011-02-12 02:53:38 +0300 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2011-02-12 02:53:38 +0300 |
commit | 2dab597441667d6c04451a7dcf215241ad4c74f6 (patch) | |
tree | f56a6f7fcabf3a9b82a5e77ef9c96268224efbd1 /fs/super.c | |
parent | d2478521afc20227658a10a8c5c2bf1a2aa615b3 (diff) | |
download | linux-2dab597441667d6c04451a7dcf215241ad4c74f6.tar.xz |
Fix possible filp_cachep memory corruption
In commit 31e6b01f4183 ("fs: rcu-walk for path lookup") we started doing
path lookup using RCU, which then falls back to a careful non-RCU lookup
in case of problems (LOOKUP_REVAL). So do_filp_open() has this "re-do
the lookup carefully" looping case.
However, that means that we must not release the open-intent file data
if we are going to loop around and use it once more!
Fix this by moving the release of the open-intent data to the function
that allocates it (do_filp_open() itself) rather than the helper
functions that can get called multiple times (finish_open() and
do_last()). This makes the logic for the lifetime of that field much
more obvious, and avoids the possible double free.
Reported-by: J. R. Okajima <hooanon05@yahoo.co.jp>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Nick Piggin <npiggin@kernel.dk>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/super.c')
0 files changed, 0 insertions, 0 deletions