Commit 67e055d1 authored by Li Zefan's avatar Li Zefan Committed by Linus Torvalds

cgroups: fix possible use after free

In cgroup_kill_sb(), root is freed before sb is detached from the list, so
another sget() may find this sb and call cgroup_test_super(), which will
access the root that has been freed.
Reported-by: default avatarAl Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
Acked-by: default avatarPaul Menage <menage@google.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 1cf6e7d8
...@@ -1122,8 +1122,8 @@ static void cgroup_kill_sb(struct super_block *sb) { ...@@ -1122,8 +1122,8 @@ static void cgroup_kill_sb(struct super_block *sb) {
mutex_unlock(&cgroup_mutex); mutex_unlock(&cgroup_mutex);
kfree(root);
kill_litter_super(sb); kill_litter_super(sb);
kfree(root);
} }
static struct file_system_type cgroup_fs_type = { static struct file_system_type cgroup_fs_type = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment