diff options
| author | Russell King <rmk+kernel@armlinux.org.uk> | 2019-06-04 14:50:14 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-08-06 19:06:49 +0200 |
| commit | a093208b4c73fcf4519828a8338245c139ecfd4b (patch) | |
| tree | b2010474b59df615ccd826f580d67b8086e6dde4 /fs/adfs | |
| parent | 85d854b421130b3f9a6bee50be9f159e578e6b6d (diff) | |
| download | linux-stable-a093208b4c73fcf4519828a8338245c139ecfd4b.tar.gz linux-stable-a093208b4c73fcf4519828a8338245c139ecfd4b.tar.bz2 linux-stable-a093208b4c73fcf4519828a8338245c139ecfd4b.zip | |
fs/adfs: super: fix use-after-free bug
[ Upstream commit 5808b14a1f52554de612fee85ef517199855e310 ]
Fix a use-after-free bug during filesystem initialisation, where we
access the disc record (which is stored in a buffer) after we have
released the buffer.
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/adfs')
| -rw-r--r-- | fs/adfs/super.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/adfs/super.c b/fs/adfs/super.c index 7e099a7a4eb1..4dc15b263489 100644 --- a/fs/adfs/super.c +++ b/fs/adfs/super.c @@ -369,6 +369,7 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent) struct buffer_head *bh; struct object_info root_obj; unsigned char *b_data; + unsigned int blocksize; struct adfs_sb_info *asb; struct inode *root; int ret = -EINVAL; @@ -420,8 +421,10 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent) goto error_free_bh; } + blocksize = 1 << dr->log2secsize; brelse(bh); - if (sb_set_blocksize(sb, 1 << dr->log2secsize)) { + + if (sb_set_blocksize(sb, blocksize)) { bh = sb_bread(sb, ADFS_DISCRECORD / sb->s_blocksize); if (!bh) { adfs_error(sb, "couldn't read superblock on " |