Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp674161img; Fri, 22 Mar 2019 06:21:06 -0700 (PDT) X-Google-Smtp-Source: APXvYqz2Z0/Xac94b1HfCvTLQVLwSwKkevGM/IbQyioRHpKIF3Rw6I/UBHQxAG1msbgeKkUt73UM X-Received: by 2002:a17:902:5c5:: with SMTP id f63mr6638749plf.64.1553260866116; Fri, 22 Mar 2019 06:21:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553260866; cv=none; d=google.com; s=arc-20160816; b=kuBGTUJA1A3S2NOsrUHahSqinHmPasfcFXW/qWaB0maureN5jYQSrULbLrMyGjgK1V JVmWm30Qq40SG5zKYiFTKhVMjonWsvVNZ+KdjkeChpshLm57i0iNMHZsDj6AKLOOr8R5 VAxvMDNhdm+lXV7mLmiCYsbbbaXTOyaSoTCgURhTZ5LshpJsyywWkxKIUDwSA2c993dF 7b4QzQhowz28U29WatqhBXwsLSN6Z07/iLgqsyfzYtjQHyjwX6srZmVN65PLyBJB2KOP 4a42JtJUD42bwOZTNRAjvBz08OZV7xGO0lgTE4cvGeQETRSW/BGKc5jBUpchOs7r5TQC 3mjw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=plXEH+VxP2Fn03KCbuVc43E+COUW4wWnUZMo/FGYPJ4=; b=QceqVcFxMG9f+JWlPj0Mli96LeYq2lIJop+qBRBOdGgy+yk0tSxPp3eF+1uNcF5RMB k4JpeG9+h5ShSRv+lVGC1Wp0LvJbsYLs/YwAj1ZTalDhQSGKM59yyg8J7x/aGCqxtKbU p6kt1Ks/IOHhvbLWnB5wClfGlXud7Lh3kxof20pZLhSlOay7Qbgv1jUHh2utceeXgR/f MP37Ln7wZlJBXod9bNLuVN0R/jKAS8gvOEJU80y6iSkHOKvr0mFfy2b/qYNCGa/0/cqy ijkbaiJPrGWoxmCncdCFni/HgfDDkDIpfKltCGrWh6U1fIhjw1e8F8eM3ReokLxLMfsa y7jg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=hRe8Gq8N; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j8si6800014pfc.101.2019.03.22.06.20.51; Fri, 22 Mar 2019 06:21:06 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=hRe8Gq8N; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728984AbfCVNTC (ORCPT + 99 others); Fri, 22 Mar 2019 09:19:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:49922 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728911AbfCVLXC (ORCPT ); Fri, 22 Mar 2019 07:23:02 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4FCD72190A; Fri, 22 Mar 2019 11:23:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553253781; bh=eGT4yrVlNJAg+5r4spQW/vtYpmx5V5HpYbNkGBvPYXY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hRe8Gq8N1ex6JYsKYnqw+66H6NHfUoreht/Rv/tsDbde9iA8YagDYbykkwoJGuJSc g0SIbu5QpaDd5NuqNyjg1HlzW2MMcjTIRuiPEZaEJyb6XiM9cYu73z1Tl1/Y4Avv7o Tnsol1t8FdfNLdafWVh6EDCLEBlAzji6pmTQXGeo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pan Bian , Ian Kent , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH 3.18 070/134] autofs: drop dentry reference only when it is never used Date: Fri, 22 Mar 2019 12:14:43 +0100 Message-Id: <20190322111215.144967332@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111210.465931067@linuxfoundation.org> References: <20190322111210.465931067@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 63ce5f552beb9bdb41546b3a26c4374758b21815 ] autofs_expire_run() calls dput(dentry) to drop the reference count of dentry. However, dentry is read via autofs_dentry_ino(dentry) after that. This may result in a use-free-bug. The patch drops the reference count of dentry only when it is never used. Link: http://lkml.kernel.org/r/154725122396.11260.16053424107144453867.stgit@pluto-themaw-net Signed-off-by: Pan Bian Signed-off-by: Ian Kent Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- fs/autofs4/expire.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c index 513b8e5d151c..4cd4b20c69db 100644 --- a/fs/autofs4/expire.c +++ b/fs/autofs4/expire.c @@ -570,7 +570,6 @@ int autofs4_expire_run(struct super_block *sb, pkt.len = dentry->d_name.len; memcpy(pkt.name, dentry->d_name.name, pkt.len); pkt.name[pkt.len] = '\0'; - dput(dentry); if ( copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)) ) ret = -EFAULT; @@ -583,6 +582,8 @@ int autofs4_expire_run(struct super_block *sb, complete_all(&ino->expire_complete); spin_unlock(&sbi->fs_lock); + dput(dentry); + return ret; } -- 2.19.1