From e8b205bf96182ccee3e4aeab5941900fa0d9e7bd Mon Sep 17 00:00:00 2001 From: Al Viro Date: Mon, 10 Jun 2019 16:48:22 +0800 Subject: [PATCH] autofs: fix use-after-free in lockless ->d_manage() mainline inclusion from mainline-5.2-rc1 commit ce285c267a003acbf607f3540ff71287f82e5282 category: bugfix bugzilla: 14537 CVE: NA --------------------------- autofs_d_release() can overlap with lockless ->d_manage(), ending up with autofs_dentry_ino() freed under the latter. Make freeing autofs_info instances RCU-delayed... Signed-off-by: Al Viro Signed-off-by: zhengbin Reviewed-by: zhangyi (F) Signed-off-by: Yang Yingliang --- fs/autofs/autofs_i.h | 1 + fs/autofs/inode.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/autofs/autofs_i.h b/fs/autofs/autofs_i.h index 9f9cadbfbd7a..1299f09a3008 100644 --- a/fs/autofs/autofs_i.h +++ b/fs/autofs/autofs_i.h @@ -69,6 +69,7 @@ struct autofs_info { kuid_t uid; kgid_t gid; + struct rcu_head rcu; }; #define AUTOFS_INF_EXPIRING (1<<0) /* dentry in the process of expiring */ diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c index 3c14a8e45ffb..84e136fd4dfd 100644 --- a/fs/autofs/inode.c +++ b/fs/autofs/inode.c @@ -36,7 +36,7 @@ void autofs_clean_ino(struct autofs_info *ino) void autofs_free_ino(struct autofs_info *ino) { - kfree(ino); + kfree_rcu(ino, rcu); } void autofs_kill_sb(struct super_block *sb) -- GitLab