summaryrefslogtreecommitdiffstats
path: root/fs/adfs
diff options
context:
space:
mode:
authorRussell King <rmk+kernel@armlinux.org.uk>2019-06-04 14:50:14 +0100
committerAl Viro <viro@zeniv.linux.org.uk>2019-06-26 20:14:14 -0400
commit5808b14a1f52554de612fee85ef517199855e310 (patch)
tree6aa2ac442dde17775864cc712af6c38b3c674eca /fs/adfs
parent4c5762f5f5e31d493678b0ee6f73585355dd3638 (diff)
downloadlinux-5808b14a1f52554de612fee85ef517199855e310.tar.gz
linux-5808b14a1f52554de612fee85ef517199855e310.tar.bz2
linux-5808b14a1f52554de612fee85ef517199855e310.zip
fs/adfs: super: fix use-after-free bug
Fix a use-after-free bug during filesystem initialisation, where we access the disc record (which is stored in a buffer) after we have released the buffer. Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/adfs')
-rw-r--r--fs/adfs/super.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/adfs/super.c b/fs/adfs/super.c
index 2f81c1c29757..b1243433add7 100644
--- a/fs/adfs/super.c
+++ b/fs/adfs/super.c
@@ -378,6 +378,7 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent)
struct buffer_head *bh;
struct object_info root_obj;
unsigned char *b_data;
+ unsigned int blocksize;
struct adfs_sb_info *asb;
struct inode *root;
int ret = -EINVAL;
@@ -423,8 +424,10 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent)
goto error_badfs;
}
+ blocksize = 1 << dr->log2secsize;
brelse(bh);
- if (sb_set_blocksize(sb, 1 << dr->log2secsize)) {
+
+ if (sb_set_blocksize(sb, blocksize)) {
bh = sb_bread(sb, ADFS_DISCRECORD / sb->s_blocksize);
if (!bh) {
adfs_msg(sb, KERN_ERR,