lkml.org 
[lkml]   [2019]   [Sep]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 124/124] vfs: Fix refcounting of filenames in fs_parser
    Date
    From: David Howells <dhowells@redhat.com>

    commit 7cdfa44227b0d8842d46a775cebe4311150cb8f2 upstream.

    Fix an overput in which filename_lookup() unconditionally drops a ref to
    the filename it was given, but this isn't taken account of in the caller,
    fs_lookup_param().

    Addresses-Coverity-ID: 1443811 ("Use after free")
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/fs_parser.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/fs/fs_parser.c
    +++ b/fs/fs_parser.c
    @@ -264,6 +264,7 @@ int fs_lookup_param(struct fs_context *f
    return invalf(fc, "%s: not usable as path", param->key);
    }

    + f->refcnt++; /* filename_lookup() drops our ref. */
    ret = filename_lookup(param->dirfd, f, flags, _path, NULL);
    if (ret < 0) {
    errorf(fc, "%s: Lookup failure for '%s'", param->key, f->name);

    \
     
     \ /
      Last update: 2019-09-20 00:12    [W:4.545 / U:0.628 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site