Description
In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)
Product status
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before d1ff475d7c83289d0a7faef346ea3bbf90818bad
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before c0aa76b0f17f59dd9c9d3463550a2986a1d592e4
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before ec2aab115eb38ac4992ea2fcc2a02fbe7af5cf48
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before 70e4f70d54e0225f91814e8610477d65f33cefe4
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before 1e555c3ed1fce4b278aaebe18a64a934cece57d8
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before 64b79e632869ad3ef6c098a4731d559381da1115
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before 81de80330fa6907aec32eb54c5619059e6e36452
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before 2a96b532098284ecf8e4849b8b9e5fc7a28bdee9
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before 2e488f13755ffbb60f307e991b27024716a33b29
4.9.331 (semver)
4.14.296 (semver)
4.19.262 (semver)
5.4.218 (semver)
5.10.148 (semver)
5.15.73 (semver)
5.19.15 (semver)
6.0.1 (semver)
6.1 (original_commit_for_fix)
References
git.kernel.org/...c/d1ff475d7c83289d0a7faef346ea3bbf90818bad
git.kernel.org/...c/c0aa76b0f17f59dd9c9d3463550a2986a1d592e4
git.kernel.org/...c/ec2aab115eb38ac4992ea2fcc2a02fbe7af5cf48
git.kernel.org/...c/70e4f70d54e0225f91814e8610477d65f33cefe4
git.kernel.org/...c/1e555c3ed1fce4b278aaebe18a64a934cece57d8
git.kernel.org/...c/64b79e632869ad3ef6c098a4731d559381da1115
git.kernel.org/...c/81de80330fa6907aec32eb54c5619059e6e36452
git.kernel.org/...c/2a96b532098284ecf8e4849b8b9e5fc7a28bdee9
git.kernel.org/...c/2e488f13755ffbb60f307e991b27024716a33b29
