lkml.org 
[lkml]   [2010]   [Oct]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] vfs: fix possible use after free in finish_open()
On Tue, Oct 26, 2010 at 12:28:48PM +0200, Miklos Szeredi wrote:
> Oops, broken patch. Here's the correct one.
>
> ----
> Subject: vfs: fix possible use after free in finish_open()
>
> From: Miklos Szeredi <mszeredi@suse.cz>
>
> In finish_open() nd->path is used after nameidata_to_filp() already
> released it. Fix by acquiring a ref to nd->path and releasing after
> the last use.

Nice catch, but I'd do it differently; that is, do not drop reference
in nameidata_to_filp() (and dup it if we do __dentry_open()) and drop
it in callers instead. Will push in a few.


\
 
 \ /
  Last update: 2010-10-29 09:01    [W:0.042 / U:1.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site