From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Pan Bian <bianpan2016@163.com>, Ian Kent <raven@themaw.net>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.14 44/45] autofs: drop dentry reference only when it is never used
Date: Sat, 23 Feb 2019 16:08:34 -0500 [thread overview]
Message-ID: <20190223210835.201708-44-sashal@kernel.org> (raw)
In-Reply-To: <20190223210835.201708-1-sashal@kernel.org>
From: Pan Bian <bianpan2016@163.com>
[ Upstream commit 63ce5f552beb9bdb41546b3a26c4374758b21815 ]
autofs_expire_run() calls dput(dentry) to drop the reference count of
dentry. However, dentry is read via autofs_dentry_ino(dentry) after
that. This may result in a use-free-bug. The patch drops the reference
count of dentry only when it is never used.
Link: http://lkml.kernel.org/r/154725122396.11260.16053424107144453867.stgit@pluto-themaw-net
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Ian Kent <raven@themaw.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/autofs4/expire.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 57725d4a8c59e..141f9bc213a3d 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -567,7 +567,6 @@ int autofs4_expire_run(struct super_block *sb,
pkt.len = dentry->d_name.len;
memcpy(pkt.name, dentry->d_name.name, pkt.len);
pkt.name[pkt.len] = '\0';
- dput(dentry);
if (copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)))
ret = -EFAULT;
@@ -580,6 +579,8 @@ int autofs4_expire_run(struct super_block *sb,
complete_all(&ino->expire_complete);
spin_unlock(&sbi->fs_lock);
+ dput(dentry);
+
return ret;
}
--
2.19.1
next prev parent reply other threads:[~2019-02-23 21:09 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-23 21:07 [PATCH AUTOSEL 4.14 01/45] vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel Sasha Levin
2019-02-23 21:07 ` [PATCH AUTOSEL 4.14 02/45] xfrm: refine validation of template and selector families Sasha Levin
2019-02-23 21:07 ` [PATCH AUTOSEL 4.14 03/45] perf core: Fix perf_proc_update_handler() bug Sasha Levin
2019-02-23 21:07 ` [PATCH AUTOSEL 4.14 04/45] perf tools: Handle TOPOLOGY headers with no CPU Sasha Levin
2019-02-23 21:07 ` [PATCH AUTOSEL 4.14 05/45] IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM Sasha Levin
2019-02-23 21:07 ` [PATCH AUTOSEL 4.14 06/45] iommu/amd: Call free_iova_fast with pfn in map_sg Sasha Levin
2019-02-23 21:07 ` [PATCH AUTOSEL 4.14 07/45] iommu/amd: Unmap all mapped pages in error path of map_sg Sasha Levin
2019-02-23 21:07 ` [PATCH AUTOSEL 4.14 08/45] ipvs: Fix signed integer overflow when setsockopt timeout Sasha Levin
2019-02-23 21:07 ` [PATCH AUTOSEL 4.14 09/45] iommu/amd: Fix IOMMU page flush when detach device from a domain Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 10/45] xtensa: SMP: fix ccount_timer_shutdown Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 11/45] selftests: cpu-hotplug: fix case where CPUs offline > CPUs present Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 12/45] xtensa: SMP: fix secondary CPU initialization Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 13/45] xtensa: smp_lx200_defconfig: fix vectors clash Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 14/45] xtensa: SMP: mark each possible CPU as present Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 15/45] xtensa: SMP: limit number of possible CPUs by NR_CPUS Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 16/45] net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 17/45] net: hns: Fix for missing of_node_put() after of_parse_phandle() Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 18/45] net: hns: Restart autoneg need return failed when autoneg off Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 19/45] net: hns: Fix wrong read accesses via Clause 45 MDIO protocol Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 20/45] net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup() Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 21/45] netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 22/45] gpio: vf610: Mask all GPIO interrupts Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 23/45] selftests: timers: use LDLIBS instead of LDFLAGS Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 24/45] nfs: Fix NULL pointer dereference of dev_name Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 25/45] qed: Fix bug in tx promiscuous mode settings Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 26/45] qed: Fix LACP pdu drops for VFs Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 27/45] qed: Fix VF probe failure while FLR Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 28/45] qed: Fix system crash in ll2 xmit Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 29/45] qed: Fix stack out of bounds bug Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 30/45] scsi: libfc: free skb when receiving invalid flogi resp Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 31/45] scsi: 53c700: pass correct "dev" to dma_alloc_attrs() Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 32/45] platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 33/45] cifs: fix computation for MAX_SMB2_HDR_SIZE Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 34/45] blk-mq: fix a hung issue when fsync Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 35/45] x86/microcode/amd: Don't falsely trick the late loading mechanism Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 36/45] arm64: kprobe: Always blacklist the KVM world-switch code Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 37/45] apparmor: Fix aa_label_build() error handling for failed merges Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 38/45] x86/kexec: Don't setup EFI info if EFI runtime is not enabled Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 39/45] x86_64: increase stack size for KASAN_EXTRA Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 40/45] mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 41/45] mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 42/45] lib/test_kmod.c: potential double free in error handling Sasha Levin
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 43/45] fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() Sasha Levin
2019-02-23 21:08 ` Sasha Levin [this message]
2019-02-23 21:08 ` [PATCH AUTOSEL 4.14 45/45] autofs: fix error return in autofs_fill_super() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190223210835.201708-44-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=bianpan2016@163.com \
--cc=linux-kernel@vger.kernel.org \
--cc=raven@themaw.net \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome