diff options
| author | Dongliang Mu <[email protected]> | 2023-02-26 12:49:47 +0000 |
|---|---|---|
| committer | Andrew Morton <[email protected]> | 2023-03-03 05:54:23 +0000 |
| commit | 07db5e247ab5858439b14dd7cc1fe538b9efcf32 (patch) | |
| tree | c208850ebb405da463e783f6c3c6dc4b39f4dd74 /tools/perf/scripts/python/intel-pt-events.py | |
| parent | panic: fix the panic_print NMI backtrace setting (diff) | |
| download | kernel-07db5e247ab5858439b14dd7cc1fe538b9efcf32.tar.gz kernel-07db5e247ab5858439b14dd7cc1fe538b9efcf32.zip | |
fs: hfsplus: fix UAF issue in hfsplus_put_super
The current hfsplus_put_super first calls hfs_btree_close on
sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an
use-after-free issue in hfsplus_release_folio.
As shown in hfsplus_fill_super, the error handling code also calls iput
before hfs_btree_close.
To fix this error, we move all iput calls before hfsplus_btree_close.
Note that this patch is tested on Syzbot.
Link: https://lkml.kernel.org/r/[email protected]
Reported-by: [email protected]
Tested-by: Dongliang Mu <[email protected]>
Signed-off-by: Dongliang Mu <[email protected]>
Cc: Bart Van Assche <[email protected]>
Cc: Jens Axboe <[email protected]>
Cc: Muchun Song <[email protected]>
Cc: Roman Gushchin <[email protected]>
Cc: "Theodore Ts'o" <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/intel-pt-events.py')
0 files changed, 0 insertions, 0 deletions