ubifs: fix use-after-free on symlink traversal

Al Viro · Al Viro · commit 0cdc17ebd207 · 2019-04-01T00:31:02.000-04:00
free the symlink body after the same RCU delay we have for freeing the
struct inode itself, so that traversal during RCU pathwalk wouldn't step
into freed memory.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
@@ -276,14 +276,12 @@ static void ubifs_i_callback(struct rcu_head *head)
 {
 	struct inode *inode = container_of(head, struct inode, i_rcu);
 	struct ubifs_inode *ui = ubifs_inode(inode);
+	kfree(ui->data);
 	kmem_cache_free(ubifs_inode_slab, ui);
 }
 
 static void ubifs_destroy_inode(struct inode *inode)
 {
-	struct ubifs_inode *ui = ubifs_inode(inode);
-
-	kfree(ui->data);
 	call_rcu(&inode->i_rcu, ubifs_i_callback);
 }
 

Original file line number	Diff line number	Diff line change
`@@ -276,14 +276,12 @@ static void ubifs_i_callback(struct rcu_head *head)`
`276`	`276`	`{`
`277`	`277`	`struct inode *inode = container_of(head, struct inode, i_rcu);`
`278`	`278`	`struct ubifs_inode *ui = ubifs_inode(inode);`
	`279`	`+ kfree(ui->data);`
`279`	`280`	`kmem_cache_free(ubifs_inode_slab, ui);`
`280`	`281`	`}`
`281`	`282`
`282`	`283`	`static void ubifs_destroy_inode(struct inode *inode)`
`283`	`284`	`{`
`284`		`- struct ubifs_inode *ui = ubifs_inode(inode);`
`285`		`-`
`286`		`- kfree(ui->data);`
`287`	`285`	`call_rcu(&inode->i_rcu, ubifs_i_callback);`
`288`	`286`	`}`
`289`	`287`