In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ufs: create the root dentry after loading cylinder metadata<\/p>\n
ufs_fill_super() installed sb->s_root before it loaded the cylinder
\ngroup structures for a writable mount:<\/p>\n
\tsb->s_root = d_make_root(inode);
\n\t…
\n\tif (!sb_rdonly(sb))
\n\t\tif (!ufs_read_cylinder_structures(sb))
\n\t\t\tgoto failed;<\/p>\n
When ufs_read_cylinder_structures() failed, the error path freed the
\nin-core superblock information and set sb->s_fs_info to NULL while
\nsb->s_root stayed installed. get_tree_bdev() then reached
\ndeactivate_locked_super(), and because s_root was present,
\ngeneric_shutdown_super() called sync_filesystem() and the put_super
\noperation. Both dereference UFS_SB(sb), which is now NULL, so a mount
\nthat fails only while reading the cylinder groups oopses during
\nteardown. A crafted image whose first cylinder group cannot be read
\nreaches this path.<\/p>\n
Load the cylinder group metadata first and create the root dentry last,
\nso the superblock is published to the VFS only once it is fully set up.
\nufs_setup_cstotal() and ufs_read_cylinder_structures() take only the
\nsuper_block and do not use the root inode, so the reordering is safe.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ufs: create the root dentry after loading cylinder metadata<\/p>\n
ufs_fill_super() installed sb->s_root before it loaded the cylinder
\ngr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29083","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29083","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29083"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29083"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29083"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}