leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fs/adfs: super: fix use-after-free bug

Browse Source 
Fix a use-after-free bug during filesystem initialisation, where we
access the disc record (which is stored in a buffer) after we have
released the buffer.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Russell King 2019-06-04 14:50:14 +01:00 committed by Al Viro
parent 4c5762f5f5
commit 5808b14a1f
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
fs/adfs/super.c
View File

@ -378,6 +378,7 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent)
struct buffer_head *bh; struct buffer_head *bh;
struct object_info root_obj; struct object_info root_obj;
unsigned char *b_data; unsigned char *b_data;
unsigned int blocksize;
struct adfs_sb_info *asb; struct adfs_sb_info *asb;
struct inode *root; struct inode *root;
int ret = -EINVAL; int ret = -EINVAL;
@ -423,8 +424,10 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent)
goto error_badfs; goto error_badfs;
} }
blocksize = 1 << dr->log2secsize;
brelse(bh); brelse(bh);
if (sb_set_blocksize(sb, 1 << dr->log2secsize)) {
if (sb_set_blocksize(sb, blocksize)) {
bh = sb_bread(sb, ADFS_DISCRECORD / sb->s_blocksize); bh = sb_bread(sb, ADFS_DISCRECORD / sb->s_blocksize);
if (!bh) { if (!bh) {
adfs_msg(sb, KERN_ERR, adfs_msg(sb, KERN_ERR,