]> git.baikalelectronics.ru Git - kernel.git/commit
jffs2: free jffs2_sb_info through jffs2_kill_sb()
authorHou Tao <houtao1@huawei.com>
Sat, 6 Oct 2018 09:09:35 +0000 (17:09 +0800)
committerBoris Brezillon <boris.brezillon@bootlin.com>
Tue, 16 Oct 2018 08:34:28 +0000 (10:34 +0200)
commit05c1f44edd8aac3414893f2440e0f4b92481d8c7
treee227bd50d9195d4826bd19e5c0df670933f3a5a3
parenta42f39d5ca91dc1f87fd4bd81170c5e34f790bb9
jffs2: free jffs2_sb_info through jffs2_kill_sb()

When an invalid mount option is passed to jffs2, jffs2_parse_options()
will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will
be used (use-after-free) and freeed (double-free) in jffs2_kill_sb().

Fix it by removing the buggy invocation of kfree() when getting invalid
mount options.

Fixes: 0d46622aa09f ("jffs2: implement mount option parsing and compression overriding")
Cc: stable@kernel.org
Signed-off-by: Hou Tao <houtao1@huawei.com>
Reviewed-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
fs/jffs2/super.c