Edward Adam Davis e0e1958f4c jfs: fix uaf in jfs_evict_inode
When the execution of diMount(ipimap) fails, the object ipimap that has been
released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs
when rcu_core() calls jfs_free_node().

Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as
ipimap.

Reported-and-tested-by: syzbot+01cf2dbcbe2022454388@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
2023-11-21 15:26:33 -06:00
..
2023-07-24 10:30:01 +02:00
2023-11-02 08:08:28 -10:00
2023-11-21 15:26:33 -06:00
2021-10-18 14:43:23 -06:00
2023-11-07 12:11:26 -08:00