| commit | 0319e32b053aa35ac0f7c38e573d6eece5c8df7c | |
| author | Al Viro <viro@zeniv.linux.org.uk> | |
| Wed, 10 Apr 2019 18:03:45 +0000 (10 14:03 -0400) | ||
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| Sat, 25 May 2019 16:25:34 +0000 (25 18:25 +0200) | ||
| tree | cbd6ed83247cb3cafe68eea1416cb237185b6db1 | treesnapshot (tar.gz zip) |
| parent | 5ac12b491772dfa0bbf5fc1beed7813a8e000269 | commitdiff |
securityfs: fix use-after-free on symlink traversal
[ Upstream commit 46c874419652bbefdfed17420fd6e88d8a31d9ec ]
symlink body shouldn't be freed without an RCU delay. Switch securityfs
to ->destroy_inode() and use of call_rcu(); free both the inode and symlink
body in the callback.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 46c874419652bbefdfed17420fd6e88d8a31d9ec ]
symlink body shouldn't be freed without an RCU delay. Switch securityfs
to ->destroy_inode() and use of call_rcu(); free both the inode and symlink
body in the callback.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| security/inode.c | diffblobblamehistory |