fs/adfs: super: fix use-after-free bug (5808b14a) · Commits · 戴 / test

Fix a use-after-free bug during filesystem initialisation, where we access the disc record (which is stored in a buffer) after we have released the buffer. Signed-off-by:

Russell King <rmk+kernel@armlinux.org.uk> Signed-off-by:

Al Viro <viro@zeniv.linux.org.uk>

fs/adfs/super.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -378,6 +378,7 @@ static int adfs_fill_super(struct super_block sb, void data, int silent)
		struct buffer_head *bh;
		struct object_info root_obj;
		unsigned char *b_data;
		unsigned int blocksize;
		struct adfs_sb_info *asb;
		struct inode *root;
		int ret = -EINVAL;
		@@ -423,8 +424,10 @@ static int adfs_fill_super(struct super_block sb, void data, int silent)
		goto error_badfs;
		}

		blocksize = 1 << dr->log2secsize;
		brelse(bh);
		if (sb_set_blocksize(sb, 1 << dr->log2secsize)) {

		if (sb_set_blocksize(sb, blocksize)) {
		bh = sb_bread(sb, ADFS_DISCRECORD / sb->s_blocksize);
		if (!bh) {
		adfs_msg(sb, KERN_ERR,

Admin message