diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2018-10-12 09:28:09 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-11-13 11:08:43 -0800 |
| commit | 15f255ec0f768bebebd8e3d9dfaad0afb9e78d4d (patch) | |
| tree | ca7f0383709640b3b7250f933a4683d45fe53fbe /security/selinux/hooks.c | |
| parent | ce1daaa84d87a633a0668307dfa279037d6e8fcd (diff) | |
ext4: fix use-after-free race in ext4_remount()'s error path
commit 33458eaba4dfe778a426df6a19b7aad2ff9f7eec upstream.
It's possible for ext4_show_quota_options() to try reading
s_qf_names[i] while it is being modified by ext4_remount() --- most
notably, in ext4_remount's error path when the original values of the
quota file name gets restored.
Reported-by: syzbot+a2872d6feea6918008a9@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 3.2+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'security/selinux/hooks.c')
0 files changed, 0 insertions, 0 deletions