diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2016-12-13 10:33:34 -0800 |
|---|---|---|
| committer | Mark Salyzyn <salyzyn@google.com> | 2017-02-07 15:21:25 +0000 |
| commit | dc2ad0661d6967e307bcdfa9172f681d21ea9a61 (patch) | |
| tree | 788ef07e82e47b85d1c50956f9e14dcd74d97b2a /fs | |
| parent | 49b60d4aa95aa0519238a06fde5c838146742796 (diff) | |
FROMLIST: 9p: fix a potential acl leak
(https://lkml.org/lkml/2016/12/13/579)
posix_acl_update_mode() could possibly clear 'acl', if so
we leak the memory pointed by 'acl'. Save this pointer
before calling posix_acl_update_mode() and release the memory
if 'acl' really gets cleared.
Reported-by: Mark Salyzyn <salyzyn@android.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Greg Kurz <groug@kaod.org>
Cc: Eric Van Hensbergen <ericvh@gmail.com>
Cc: Ron Minnich <rminnich@sandia.gov>
Cc: Latchesar Ionkov <lucho@ionkov.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Bug: 32458736
Change-Id: Ia78da401e6fd1bfd569653bd2cd0ebd3f9c737a0
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/9p/acl.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/9p/acl.c b/fs/9p/acl.c index 929b618da43b..c30c6ceac2c4 100644 --- a/fs/9p/acl.c +++ b/fs/9p/acl.c @@ -283,6 +283,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler, case ACL_TYPE_ACCESS: if (acl) { struct iattr iattr; + struct posix_acl *old_acl = acl; retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl); if (retval) @@ -293,6 +294,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler, * by the mode bits. So don't * update ACL. */ + posix_acl_release(old_acl); value = NULL; size = 0; } |