RTOS/rtems
1
0
Fork 0
forked from Imagelibrary/rtems
Code Pull Requests Activity

jffs2: fix use-after-free on symlink traversal

Browse Source 
free the symlink body after the same RCU delay we have for freeing the
struct inode itself, so that traversal during RCU pathwalk wouldn't step
into freed memory.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro
2019-03-26 01:39:50 +00:00
committed by Sebastian Huber
parent 55529cf3d0
commit 22e83b00f5
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
cpukit/libfs/src/jffs2/src/readinode.c
View File

@@ -1434,11 +1434,12 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
}
jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
#ifdef __rtems__
if (f->target) {
kfree(f->target);
f->target = NULL;
}
#endif /* __rtems__ */
fds = f->dents;
while(fds) {