aboutsummaryrefslogtreecommitdiffstats
path: root/fs/debugfs
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2011-02-07 15:00:27 +0100
committerGreg Kroah-Hartman <gregkh@suse.de>2011-02-18 08:07:18 -0800
commit25d41d8455ec1ee7433e146ee94436dc4195f420 (patch)
tree2f5bc09d4ac7024d08fa8c1c0988171d8b792fcb /fs/debugfs
parentb38360a284f8acab4ae431b387c05a4e19ff4129 (diff)
downloadkernel_samsung_smdk4412-25d41d8455ec1ee7433e146ee94436dc4195f420.zip
kernel_samsung_smdk4412-25d41d8455ec1ee7433e146ee94436dc4195f420.tar.gz
kernel_samsung_smdk4412-25d41d8455ec1ee7433e146ee94436dc4195f420.tar.bz2
debugfs: Fix filesystem reference counting on debugfs_remove() failure
When __debugfs_remove() fails (because simple_rmdir() fails e.g. when a directory is not empty), we must not decrement use count of the filesystem as nothing was in fact deleted. This fixes use after free caused by debugfs in some cases. Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'fs/debugfs')
-rw-r--r--fs/debugfs/inode.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index d38c88f..e7a7a2f 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -307,7 +307,7 @@ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
}
EXPORT_SYMBOL_GPL(debugfs_create_symlink);
-static void __debugfs_remove(struct dentry *dentry, struct dentry *parent)
+static int __debugfs_remove(struct dentry *dentry, struct dentry *parent)
{
int ret = 0;
@@ -330,6 +330,7 @@ static void __debugfs_remove(struct dentry *dentry, struct dentry *parent)
dput(dentry);
}
}
+ return ret;
}
/**
@@ -348,7 +349,8 @@ static void __debugfs_remove(struct dentry *dentry, struct dentry *parent)
void debugfs_remove(struct dentry *dentry)
{
struct dentry *parent;
-
+ int ret;
+
if (!dentry)
return;
@@ -357,9 +359,10 @@ void debugfs_remove(struct dentry *dentry)
return;
mutex_lock(&parent->d_inode->i_mutex);
- __debugfs_remove(dentry, parent);
+ ret = __debugfs_remove(dentry, parent);
mutex_unlock(&parent->d_inode->i_mutex);
- simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ if (!ret)
+ simple_release_fs(&debugfs_mount, &debugfs_mount_count);
}
EXPORT_SYMBOL_GPL(debugfs_remove);