diff options
| author | Li Zefan | 2009-02-18 14:48:20 -0800 |
|---|---|---|
| committer | Linus Torvalds | 2009-02-18 15:37:54 -0800 |
| commit | 67e055d144c5b2acdc1c63811fde031263bf92c5 (patch) | |
| tree | 6bdb0af25cc30d7bc8a8d54db3625f8486c2f5f9 /kernel | |
| parent | 1cf6e7d83bf334cc5916137862c920a97aabc018 (diff) | |
cgroups: fix possible use after free
In cgroup_kill_sb(), root is freed before sb is detached from the list, so
another sget() may find this sb and call cgroup_test_super(), which will
access the root that has been freed.
Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Paul Menage <menage@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/cgroup.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/cgroup.c b/kernel/cgroup.c index e14db9c089b9..9edb5c4b79b4 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -1122,8 +1122,8 @@ static void cgroup_kill_sb(struct super_block *sb) { mutex_unlock(&cgroup_mutex); - kfree(root); kill_litter_super(sb); + kfree(root); } static struct file_system_type cgroup_fs_type = { |