History

autofs: fix use-after-free in lockless ->d_manage()

autofs_d_release() can overlap with lockless ->d_manage(), ending up with autofs_dentry_ino() freed under the latter. Make freeing autofs_info instances RCU-delayed...

Al Viro committed 7 years ago

Commit ce285c21 parent 5467a682 files · +2 −1Browse files

Unified · Split

2 files
  1. fs/autofs/autofs_i.h +1 −0
  2. fs/autofs/inode.c +1 −1
fs/autofs/autofs_i.h+1−0
@@ -71,6 +71,7 @@ struct autofs_info { · 70 unmodified lines
71 71
72 kuid_t uid;72 kuid_t uid;
73 kgid_t gid;73 kgid_t gid;
74 struct rcu_head rcu;
74};75};
75 76
76#define AUTOFS_INF_EXPIRING (1<<0) /* dentry in the process of expiring */77#define AUTOFS_INF_EXPIRING (1<<0) /* dentry in the process of expiring */
fs/autofs/inode.c+1−1
@@ -36,7 +36,7 @@ void autofs_clean_ino(struct autofs_info *ino) · 35 unmodified lines
36 36
37void autofs_free_ino(struct autofs_info *ino)37void autofs_free_ino(struct autofs_info *ino)
38{38{
39 kfree(ino);39 kfree_rcu(ino, rcu);
40}40}
41 41
42void autofs_kill_sb(struct super_block *sb)42void autofs_kill_sb(struct super_block *sb)