mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-11 12:28:41 +08:00
cgroups: fix possible use after free
In cgroup_kill_sb(), root is freed before sb is detached from the list, so another sget() may find this sb and call cgroup_test_super(), which will access the root that has been freed. Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Acked-by: Paul Menage <menage@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
1cf6e7d83b
commit
67e055d144
@ -1122,8 +1122,8 @@ static void cgroup_kill_sb(struct super_block *sb) {
|
||||
|
||||
mutex_unlock(&cgroup_mutex);
|
||||
|
||||
kfree(root);
|
||||
kill_litter_super(sb);
|
||||
kfree(root);
|
||||
}
|
||||
|
||||
static struct file_system_type cgroup_fs_type = {
|
||||
|
Loading…
Reference in New Issue
Block a user