mirror of
https://github.com/torvalds/linux.git
synced 2024-10-26 06:54:41 +00:00
9b5a04ac3a
During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). However, since nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may cause use-after-free read if inodes are left in "garbage_list" and released by nilfs_dispose_list() at the end of nilfs_detach_log_writer(). Fix this issue by modifying nilfs_evict_inode() to only clear inode without additional metadata changes that use nilfs_root if the file system is degraded to read-only or the writer is detached. Link: https://lkml.kernel.org/r/20230509152956.8313-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Reported-by: syzbot+78d4495558999f55d1da@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/00000000000099e5ac05fb1c3b85@google.com Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
---|---|---|
.. | ||
alloc.c | ||
alloc.h | ||
bmap.c | ||
bmap.h | ||
btnode.c | ||
btnode.h | ||
btree.c | ||
btree.h | ||
cpfile.c | ||
cpfile.h | ||
dat.c | ||
dat.h | ||
dir.c | ||
direct.c | ||
direct.h | ||
export.h | ||
file.c | ||
gcinode.c | ||
ifile.c | ||
ifile.h | ||
inode.c | ||
ioctl.c | ||
Kconfig | ||
Makefile | ||
mdt.c | ||
mdt.h | ||
namei.c | ||
nilfs.h | ||
page.c | ||
page.h | ||
recovery.c | ||
segbuf.c | ||
segbuf.h | ||
segment.c | ||
segment.h | ||
sufile.c | ||
sufile.h | ||
super.c | ||
sysfs.c | ||
sysfs.h | ||
the_nilfs.c | ||
the_nilfs.h |