linux/fs/coda/cache.c
Al Viro e252ed8988 coda_flag_children(): fix a UAF
if de goes negative right under us, there's nothing to prevent inode
getting freed just as we call coda_flag_inode().  We are not holding
->d_lock, so it's not impossible.  Not going to be reproducible on
bare hardware unless it's a realtime config, but it could happen on KVM.

Trivial to fix - just hold rcu_read_lock() over that loop.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-04-04 21:03:13 -04:00

121 lines
3 KiB