summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2011-02-07 15:00:27 +0100
committerGreg Kroah-Hartman <gregkh@suse.de>2011-02-18 08:07:18 -0800
commit25d41d8455ec1ee7433e146ee94436dc4195f420 (patch)
tree2f5bc09d4ac7024d08fa8c1c0988171d8b792fcb
parentb38360a284f8acab4ae431b387c05a4e19ff4129 (diff)
debugfs: Fix filesystem reference counting on debugfs_remove() failure
When __debugfs_remove() fails (because simple_rmdir() fails e.g. when a directory is not empty), we must not decrement use count of the filesystem as nothing was in fact deleted. This fixes use after free caused by debugfs in some cases. Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--fs/debugfs/inode.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index d38c88fb63ae..e7a7a2f07324 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -307,7 +307,7 @@ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
}
EXPORT_SYMBOL_GPL(debugfs_create_symlink);
-static void __debugfs_remove(struct dentry *dentry, struct dentry *parent)
+static int __debugfs_remove(struct dentry *dentry, struct dentry *parent)
{
int ret = 0;
@@ -330,6 +330,7 @@ static void __debugfs_remove(struct dentry *dentry, struct dentry *parent)
dput(dentry);
}
}
+ return ret;
}
/**
@@ -348,7 +349,8 @@ static void __debugfs_remove(struct dentry *dentry, struct dentry *parent)
void debugfs_remove(struct dentry *dentry)
{
struct dentry *parent;
-
+ int ret;
+
if (!dentry)
return;
@@ -357,9 +359,10 @@ void debugfs_remove(struct dentry *dentry)
return;
mutex_lock(&parent->d_inode->i_mutex);
- __debugfs_remove(dentry, parent);
+ ret = __debugfs_remove(dentry, parent);
mutex_unlock(&parent->d_inode->i_mutex);
- simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ if (!ret)
+ simple_release_fs(&debugfs_mount, &debugfs_mount_count);
}
EXPORT_SYMBOL_GPL(debugfs_remove);