提交 24fb33d4 编写于 作者: A Al Viro 提交者: Linus Torvalds

fix breakage in do_rmdir()

syzbot reported and bisected a use-after-free due to the recent init
cleanups.

The putname() should happen only after we'd *not* branched to retry,
same as it's done in do_unlinkat().

Reported-by: syzbot+bbeb1c88016c7db4aa24@syzkaller.appspotmail.com
Fixes: e24ab0ef "fs: push the getname from do_rmdir into the callers"
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 fb893de3
...@@ -3770,11 +3770,11 @@ long do_rmdir(int dfd, struct filename *name) ...@@ -3770,11 +3770,11 @@ long do_rmdir(int dfd, struct filename *name)
mnt_drop_write(path.mnt); mnt_drop_write(path.mnt);
exit1: exit1:
path_put(&path); path_put(&path);
putname(name);
if (retry_estale(error, lookup_flags)) { if (retry_estale(error, lookup_flags)) {
lookup_flags |= LOOKUP_REVAL; lookup_flags |= LOOKUP_REVAL;
goto retry; goto retry;
} }
putname(name);
return error; return error;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册