linux/fs/fuse/inode.c
Al Viro 535e9bd0e8 fuse: fix UAF in rcu pathwalks
[ Upstream commit 053fc4f755 ]

->permission(), ->get_link() and ->inode_get_acl() might dereference
->s_fs_info (and, in case of ->permission(), ->s_fs_info->fc->user_ns
as well) when called from rcu pathwalk.

Freeing ->s_fs_info->fc is rcu-delayed; we need to make freeing ->s_fs_info
and dropping ->user_ns rcu-delayed too.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-08-29 17:33:33 +02:00

2120 lines
50 KiB