diff options
author | Jan Kara <jack@suse.cz> | 2016-12-12 15:08:41 (GMT) |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-01-09 07:32:22 (GMT) |
commit | d06485e0fcf58a88daadcbe119a7d433cdaad8e6 (patch) | |
tree | 06722f54f2b8a7d3ba84ada46805dc1d7d5ac22e /fs/dlm/memory.h | |
parent | 3f618a0b872fea38c7d1d1f79eda40f88c6466c2 (diff) | |
download | linux-d06485e0fcf58a88daadcbe119a7d433cdaad8e6.tar.xz |
fsnotify: Fix possible use-after-free in inode iteration on umount
commit 5716863e0f8251d3360d4cbfc0e44e08007075df upstream.
fsnotify_unmount_inodes() plays complex tricks to pin next inode in the
sb->s_inodes list when iterating over all inodes. Furthermore the code has a
bug that if the current inode is the last on i_sb_list that does not have e.g.
I_FREEING set, then we leave next_i pointing to inode which may get removed
from the i_sb_list once we drop s_inode_list_lock thus resulting in
use-after-free issues (usually manifesting as infinite looping in
fsnotify_unmount_inodes()).
Fix the problem by keeping current inode pinned somewhat longer. Then we can
make the code much simpler and standard.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/dlm/memory.h')
0 files changed, 0 insertions, 0 deletions