diff options
author | Jan Kara <jack@suse.cz> | 2016-12-12 18:08:41 +0300 |
---|---|---|
committer | Jan Kara <jack@suse.cz> | 2016-12-13 14:57:52 +0300 |
commit | 5716863e0f8251d3360d4cbfc0e44e08007075df (patch) | |
tree | 4f6ebe911e257e49154b4741c117e2354d77ed4a /fs/quota | |
parent | b46dc033818d3293ecc49dc258e2efb603c80bd7 (diff) | |
download | linux-5716863e0f8251d3360d4cbfc0e44e08007075df.tar.xz |
fsnotify: Fix possible use-after-free in inode iteration on umount
fsnotify_unmount_inodes() plays complex tricks to pin next inode in the
sb->s_inodes list when iterating over all inodes. Furthermore the code has a
bug that if the current inode is the last on i_sb_list that does not have e.g.
I_FREEING set, then we leave next_i pointing to inode which may get removed
from the i_sb_list once we drop s_inode_list_lock thus resulting in
use-after-free issues (usually manifesting as infinite looping in
fsnotify_unmount_inodes()).
Fix the problem by keeping current inode pinned somewhat longer. Then we can
make the code much simpler and standard.
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/quota')
0 files changed, 0 insertions, 0 deletions