diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2023-09-19 15:53:32 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2024-02-25 02:10:31 -0500 |
| commit | a13d1a4de3b0fe3c41d818697d691c886c5585fa (patch) | |
| tree | 11151a4b7d601adc3841c7d1ecb6f3d53f1aa932 /fs/exfat/exfat_fs.h | |
| parent | 529f89a9e4531e80c44871d7d0c30df6540c20e5 (diff) | |
| download | lwn-a13d1a4de3b0fe3c41d818697d691c886c5585fa.tar.gz lwn-a13d1a4de3b0fe3c41d818697d691c886c5585fa.zip | |
exfat: move freeing sbi, upcase table and dropping nls into rcu-delayed helper
That stuff can be accessed by ->d_hash()/->d_compare(); as it is, we have
a hard-to-hit UAF if rcu pathwalk manages to get into ->d_hash() on a filesystem
that is in process of getting shut down.
Besides, having nls and upcase table cleanup moved from ->put_super() towards
the place where sbi is freed makes for simpler failure exits.
Acked-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/exfat/exfat_fs.h')
| -rw-r--r-- | fs/exfat/exfat_fs.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h index 9474cd50da6d..361595433480 100644 --- a/fs/exfat/exfat_fs.h +++ b/fs/exfat/exfat_fs.h @@ -275,6 +275,7 @@ struct exfat_sb_info { spinlock_t inode_hash_lock; struct hlist_head inode_hashtable[EXFAT_HASH_SIZE]; + struct rcu_head rcu; }; #define EXFAT_CACHE_VALID 0 |