git.maquefel.me Git - linux.git/commit

author	Edward Adam Davis <eadavis@qq.com>
	Tue, 31 Oct 2023 05:39:04 +0000 (13:39 +0800)
committer	Dave Kleikamp <dave.kleikamp@oracle.com>
	Tue, 21 Nov 2023 21:26:33 +0000 (15:26 -0600)
commit	e0e1958f4c365e380b17ccb35617345b31ef7bf3
tree	a3336c1a307df071e9d02057988c53ac0566067a	tree \| snapshot
parent	74ecdda68242b174920fe7c6133a856fb7d8559b	commit \| diff

jfs: fix uaf in jfs_evict_inode

When the execution of diMount(ipimap) fails, the object ipimap that has been
released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs
when rcu_core() calls jfs_free_node().

Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as
ipimap.

Reported-and-tested-by: syzbot+01cf2dbcbe2022454388@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>