lkml.org 
[lkml]   [2018]   [Dec]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 20/88] exportfs: do not read dentry after free
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit 2084ac6c505a58f7efdec13eba633c6aaa085ca5 ]

    The function dentry_connected calls dput(dentry) to drop the previously
    acquired reference to dentry. In this case, dentry can be released.
    After that, IS_ROOT(dentry) checks the condition
    (dentry == dentry->d_parent), which may result in a use-after-free bug.
    This patch directly compares dentry with its parent obtained before
    dropping the reference.

    Fixes: a056cc8934c("exportfs: stop retrying once we race with
    rename/remove")

    Signed-off-by: Pan Bian <bianpan2016@163.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/exportfs/expfs.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
    index 714cd37a6ba3..6599c6124552 100644
    --- a/fs/exportfs/expfs.c
    +++ b/fs/exportfs/expfs.c
    @@ -76,7 +76,7 @@ static bool dentry_connected(struct dentry *dentry)
    struct dentry *parent = dget_parent(dentry);

    dput(dentry);
    - if (IS_ROOT(dentry)) {
    + if (dentry == parent) {
    dput(parent);
    return false;
    }
    --
    2.19.1


    \
     
     \ /
      Last update: 2018-12-14 13:23    [W:4.989 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site