| commit | b50282f3241acee880514212d88b6049fb5039c8 | [log] [tgz] |
|---|---|---|
| author | Theodore Ts'o <tytso@mit.edu> | Mon Aug 27 01:47:09 2018 -0400 |
| committer | Theodore Ts'o <tytso@mit.edu> | Mon Aug 27 01:47:09 2018 -0400 |
| tree | b848cc5a2dce967053f7e1c63ee782e619100b07 | |
| parent | 072ebb3bffe67d71d1f1e52add799f4491eab691 [diff] |
ext4: check to make sure the rename(2)'s destination is not freed If the destination of the rename(2) system call exists, the inode's link count (i_nlinks) must be non-zero. If it is, the inode can end up on the orphan list prematurely, leading to all sorts of hilarity, including a use-after-free. https://bugzilla.kernel.org/show_bug.cgi?id=200931 Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reported-by: Wen Xu <wen.xu@gatech.edu> Cc: stable@vger.kernel.org