diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2019-03-26 01:39:50 +0000 |
|---|---|---|
| committer | Sebastian Huber <sebastian.huber@embedded-brains.de> | 2022-06-20 13:25:32 +0200 |
| commit | 22e83b00f5bcac4b0f306735ba7c84d7522d903d (patch) | |
| tree | 7564c3ecacc66fee3ec620f57a696f629a0a6e36 /cpukit/libfs | |
| parent | Convert jffs2 acl to struct_size (diff) | |
| download | rtems-22e83b00f5bcac4b0f306735ba7c84d7522d903d.tar.bz2 | |
jffs2: fix use-after-free on symlink traversal
free the symlink body after the same RCU delay we have for freeing the
struct inode itself, so that traversal during RCU pathwalk wouldn't step
into freed memory.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'cpukit/libfs')
| -rw-r--r-- | cpukit/libfs/src/jffs2/src/readinode.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/cpukit/libfs/src/jffs2/src/readinode.c b/cpukit/libfs/src/jffs2/src/readinode.c index e6c9452c03..c4e32ead47 100644 --- a/cpukit/libfs/src/jffs2/src/readinode.c +++ b/cpukit/libfs/src/jffs2/src/readinode.c @@ -1434,11 +1434,12 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f) } jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL); - +#ifdef __rtems__ if (f->target) { kfree(f->target); f->target = NULL; } +#endif /* __rtems__ */ fds = f->dents; while(fds) { |