| commit | 33458eaba4dfe778a426df6a19b7aad2ff9f7eec | [log] [tgz] |
|---|---|---|
| author | Theodore Ts'o <tytso@mit.edu> | Fri Oct 12 09:28:09 2018 -0400 |
| committer | Theodore Ts'o <tytso@mit.edu> | Fri Oct 12 09:28:09 2018 -0400 |
| tree | f4732bd54c93bd877209855b3148db771da85b55 | |
| parent | 6fd941784b8ac3e74313f7112f0586076dc36544 [diff] |
ext4: fix use-after-free race in ext4_remount()'s error path It's possible for ext4_show_quota_options() to try reading s_qf_names[i] while it is being modified by ext4_remount() --- most notably, in ext4_remount's error path when the original values of the quota file name gets restored. Reported-by: syzbot+a2872d6feea6918008a9@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org # 3.2+