diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2021-07-02 19:45:02 +0300 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2021-07-08 15:36:09 +0300 |
| commit | 61bb4a1c417e5b95d9edb4f887f131de32e419cb (patch) | |
| tree | d51138e82d0fbc32dcd728bd6317646ea0b4ba1b /fs/ext4/ioctl.c | |
| parent | cd84bbbac12a173a381a64c6ec8b76a5277b87b5 (diff) | |
| download | linux-61bb4a1c417e5b95d9edb4f887f131de32e419cb.tar.xz | |
ext4: fix possible UAF when remounting r/o a mmp-protected file system
After commit 618f003199c6 ("ext4: fix memory leak in
ext4_fill_super"), after the file system is remounted read-only, there
is a race where the kmmpd thread can exit, causing sbi->s_mmp_tsk to
point at freed memory, which the call to ext4_stop_mmpd() can trip
over.
Fix this by only allowing kmmpd() to exit when it is stopped via
ext4_stop_mmpd().
Link: https://lore.kernel.org/r/20210707002433.3719773-1-tytso@mit.edu
Reported-by: Ye Bin <yebin10@huawei.com>
Bug-Report-Link: <20210629143603.2166962-1-yebin10@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/ext4/ioctl.c')
0 files changed, 0 insertions, 0 deletions