Messages in this thread | | | Subject | Re: [PATCH] jffs2: move jffs2_init_inode_info() just after allocating inode | From | "zhangyi (F)" <> | Date | Mon, 20 Jan 2020 19:44:51 +0800 |
| |
ping.
On 2020/1/6 16:04, zhangyi (F) wrote: > After commit 4fdcfab5b553 ("jffs2: fix use-after-free on symlink > traversal"), it expose a freeing uninitialized memory problem due to > this commit move the operaion of freeing f->target to > jffs2_i_callback(), which may not be initialized in some error path of > allocating jffs2 inode (eg: jffs2_iget()->iget_locked()-> > destroy_inode()->..->jffs2_i_callback()->kfree(f->target)). > > Fix this by initialize the jffs2_inode_info just after allocating it. > > Reported-by: Guohua Zhong <zhongguohua1@huawei.com> > Reported-by: Huaijie Yi <yihuaijie@huawei.com> > Signed-off-by: zhangyi (F) <yi.zhang@huawei.com> > Cc: stable@vger.kernel.org > --- > fs/jffs2/fs.c | 2 -- > fs/jffs2/super.c | 2 ++ > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c > index ab8cdd9e9325..50a9df7d43a5 100644 > --- a/fs/jffs2/fs.c > +++ b/fs/jffs2/fs.c > @@ -270,7 +270,6 @@ struct inode *jffs2_iget(struct super_block *sb, unsigned long ino) > f = JFFS2_INODE_INFO(inode); > c = JFFS2_SB_INFO(inode->i_sb); > > - jffs2_init_inode_info(f); > mutex_lock(&f->sem); > > ret = jffs2_do_read_inode(c, f, inode->i_ino, &latest_node); > @@ -438,7 +437,6 @@ struct inode *jffs2_new_inode (struct inode *dir_i, umode_t mode, struct jffs2_r > return ERR_PTR(-ENOMEM); > > f = JFFS2_INODE_INFO(inode); > - jffs2_init_inode_info(f); > mutex_lock(&f->sem); > > memset(ri, 0, sizeof(*ri)); > diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c > index 0e6406c4f362..90373898587f 100644 > --- a/fs/jffs2/super.c > +++ b/fs/jffs2/super.c > @@ -42,6 +42,8 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb) > f = kmem_cache_alloc(jffs2_inode_cachep, GFP_KERNEL); > if (!f) > return NULL; > + > + jffs2_init_inode_info(f); > return &f->vfs_inode; > } > >
| |