Skip to content

GitLab

Switch branch/tag
History Find file
Clone
fs: fix UAF/GPF bug in nilfs_mdt_destroy
Dongliang Mu authored 
commit 2e488f13 upstream.

In alloc_inode, inode_init_always() could return -ENOMEM if
security_inode_alloc() fails, which causes inode->i_private
uninitialized. Then nilfs_is_metadata_file_inode() returns
true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(),
which frees the uninitialized inode->i_private
and leads to crashes(e.g., UAF/GPF).

Fix this by moving security_inode_alloc just prior to
this_cpu_inc(nr_inodes)

Link: https://lkml.kernel.org/r/CAFcO6XOcf1Jj2SeGt=jJV59wmhESeSKpfR0omdFRq+J9nD1vfQ@mail.gmail.com

Reported-by: default avatarbutt3rflyh4ck <butterflyhuangxx@gmail.com>
Reported-by: default avatarHao Sun <sunhao.th@gmail.com>
Reported-by: default avatarJiacheng Xu <stitch@zju.edu.cn>
Reviewed-by: default avatarChristian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: default avatarDongliang Mu <mudongliangabcd@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <g...
81de8033
Name Last commit Last update
Documentation docs: update mediator information in CoC docs
LICENSES LICENSES/LGPL-2.1: Add LGPL-2.1-or-later as valid identifiers
arch sparc: Unbreak the build
block Revert "block: freeze the queue earlier in del_gendisk"
certs certs: make system keyring depend on built-in x509 parser
crypto KEYS: asymmetric: enforce SM2 signature use pkey algo
drivers net: ethernet: mtk_eth_soc: fix mask of RX_DMA_GET_SPORT{,_V2}
fs fs: fix UAF/GPF bug in nilfs_mdt_destroy
include xsk: Inherit need_wakeup flag for shared sockets
init arm64: fix rodata=full
io_uring io_uring: ensure that cached task references are always put on exit
ipc ipc: Free mq_sysctls if ipc namespace creation failed
kernel workqueue: don't skip lockdep work dependency in cancel_work_sync()
lib Makefile.debug: re-enable debug info for .S files
mm damon/sysfs: fix possible memleak on damon_sysfs_add_target
net xsk: Inherit need_wakeup flag for shared sockets
samples sample: bpf: xdp_router_ipv4: Allow the kernel to send arp requests
scripts Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
security hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
sound ASoC: tas2770: Reinit regcache on reset
tools perf tests record: Fail the test if the 'errs' counter is not zero
usr Merge tag 'mm-nonmm-stable-2022-05-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
virt KVM: Unconditionally get a ref to /dev/kvm module when creating a VM
.clang-format clang-format: Fix space after for_each macros
.cocciconfig scripts: add Linux .cocciconfig for coccinelle
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile
README
README
Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.