lkml.org 
[lkml]   [2018]   [Nov]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 003/141] jffs2: free jffs2_sb_info through jffs2_kill_sb()
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Hou Tao <houtao1@huawei.com>

    commit 92e2921f7eee63450a5f953f4b15dc6210219430 upstream.

    When an invalid mount option is passed to jffs2, jffs2_parse_options()
    will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will
    be used (use-after-free) and freeed (double-free) in jffs2_kill_sb().

    Fix it by removing the buggy invocation of kfree() when getting invalid
    mount options.

    Fixes: 92abc475d8de ("jffs2: implement mount option parsing and compression overriding")
    Cc: stable@kernel.org
    Signed-off-by: Hou Tao <houtao1@huawei.com>
    Reviewed-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/jffs2/super.c | 4 +---
    1 file changed, 1 insertion(+), 3 deletions(-)

    --- a/fs/jffs2/super.c
    +++ b/fs/jffs2/super.c
    @@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super
    sb->s_fs_info = c;

    ret = jffs2_parse_options(c, data);
    - if (ret) {
    - kfree(c);
    + if (ret)
    return -EINVAL;
    - }

    /* Initialize JFFS2 superblock locks, the further initialization will
    * be done later */

    \
     
     \ /
      Last update: 2018-11-11 23:48    [W:4.160 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site