autofs: fix use-after-free in lockless ->d_manage()
authorAl Viro <viro@zeniv.linux.org.uk>
Tue, 2 Apr 2019 19:17:34 +0000 (15:17 -0400)
committerAl Viro <viro@zeniv.linux.org.uk>
Tue, 9 Apr 2019 23:18:19 +0000 (19:18 -0400)
autofs_d_release() can overlap with lockless ->d_manage(),
ending up with autofs_dentry_ino() freed under the latter.
Make freeing autofs_info instances RCU-delayed...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/autofs/autofs_i.h
fs/autofs/inode.c

index 70c132acdab1bcfe764f7aa28efe7be2c035e63b..e1091312abe1d88a1e7ae17f725f99ee93c4729b 100644 (file)
@@ -71,6 +71,7 @@ struct autofs_info {
 
        kuid_t uid;
        kgid_t gid;
+       struct rcu_head rcu;
 };
 
 #define AUTOFS_INF_EXPIRING    (1<<0) /* dentry in the process of expiring */
index 80597b88718b205f363cd2d93500bb7c3c1b9b29..fb0225f21c12550aceeebd7cb3779be553ab5885 100644 (file)
@@ -36,7 +36,7 @@ void autofs_clean_ino(struct autofs_info *ino)
 
 void autofs_free_ino(struct autofs_info *ino)
 {
-       kfree(ino);
+       kfree_rcu(ino, rcu);
 }
 
 void autofs_kill_sb(struct super_block *sb)