Commit ce285c26 authored by Al Viro's avatar Al Viro
Browse files

autofs: fix use-after-free in lockless ->d_manage() 



autofs_d_release() can overlap with lockless ->d_manage(),
ending up with autofs_dentry_ino() freed under the latter.
Make freeing autofs_info instances RCU-delayed...

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 5467a68c

fs/autofs/autofs_i.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -71,6 +71,7 @@ struct autofs_info { 




	kuid_t uid;

	kuid_t uid;

	kgid_t gid;

	kgid_t gid;

	struct rcu_head rcu;

};

};





#define AUTOFS_INF_EXPIRING	(1<<0) /* dentry in the process of expiring */

#define AUTOFS_INF_EXPIRING	(1<<0) /* dentry in the process of expiring */

fs/autofs/inode.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -36,7 +36,7 @@ void autofs_clean_ino(struct autofs_info *ino) 




void autofs_free_ino(struct autofs_info *ino)

void autofs_free_ino(struct autofs_info *ino)

{

{

	kfree(ino);

	kfree_rcu(ino, rcu);

}

}





void autofs_kill_sb(struct super_block *sb)

void autofs_kill_sb(struct super_block *sb)

CRA Git | Maintained and supported by SUSTech CRA and CCSE