From 25d41d8455ec1ee7433e146ee94436dc4195f420 Mon Sep 17 00:00:00 2001 From: Jan Kara Date: Mon, 7 Feb 2011 15:00:27 +0100 Subject: debugfs: Fix filesystem reference counting on debugfs_remove() failure When __debugfs_remove() fails (because simple_rmdir() fails e.g. when a directory is not empty), we must not decrement use count of the filesystem as nothing was in fact deleted. This fixes use after free caused by debugfs in some cases. Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman --- fs/debugfs/inode.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c index d38c88fb63ae..e7a7a2f07324 100644 --- a/fs/debugfs/inode.c +++ b/fs/debugfs/inode.c @@ -307,7 +307,7 @@ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent, } EXPORT_SYMBOL_GPL(debugfs_create_symlink); -static void __debugfs_remove(struct dentry *dentry, struct dentry *parent) +static int __debugfs_remove(struct dentry *dentry, struct dentry *parent) { int ret = 0; @@ -330,6 +330,7 @@ static void __debugfs_remove(struct dentry *dentry, struct dentry *parent) dput(dentry); } } + return ret; } /** @@ -348,7 +349,8 @@ static void __debugfs_remove(struct dentry *dentry, struct dentry *parent) void debugfs_remove(struct dentry *dentry) { struct dentry *parent; - + int ret; + if (!dentry) return; @@ -357,9 +359,10 @@ void debugfs_remove(struct dentry *dentry) return; mutex_lock(&parent->d_inode->i_mutex); - __debugfs_remove(dentry, parent); + ret = __debugfs_remove(dentry, parent); mutex_unlock(&parent->d_inode->i_mutex); - simple_release_fs(&debugfs_mount, &debugfs_mount_count); + if (!ret) + simple_release_fs(&debugfs_mount, &debugfs_mount_count); } EXPORT_SYMBOL_GPL(debugfs_remove); -- cgit v1.2.3