Patch "hostfs: fix memory handling in follow_link()" has been added to the 5.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    hostfs: fix memory handling in follow_link()

to the 5.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hostfs-fix-memory-handling-in-follow_link.patch
and it can be found in the queue-5.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 65a846cd40983bf72d5b93fe43ce3010a0fd53d5
Author: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Date:   Thu Mar 25 14:12:34 2021 -0400

    hostfs: fix memory handling in follow_link()
    
    [ Upstream commit 7f6c411c9b50cfab41cc798e003eff27608c7016 ]
    
    1) argument should not be freed in any case - the caller already has
    it as ->s_fs_info (and uses it a lot afterwards)
    2) allocate readlink buffer with kmalloc() - the caller has no way
    to tell if it's got that (on absolute symlink) or a result of
    kasprintf().  Sure, for SLAB and SLUB kfree() works on results of
    kmem_cache_alloc(), but that's not documented anywhere, might change
    in the future *and* is already not true for SLOB.
    
    Fixes: 52b209f7b848 ("get rid of hostfs_read_inode()")
    Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index aea35459d390..07467ca0f71d 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -142,7 +142,7 @@ static char *follow_link(char *link)
 	char *name, *resolved, *end;
 	int n;
 
-	name = __getname();
+	name = kmalloc(PATH_MAX, GFP_KERNEL);
 	if (!name) {
 		n = -ENOMEM;
 		goto out_free;
@@ -171,12 +171,11 @@ static char *follow_link(char *link)
 		goto out_free;
 	}
 
-	__putname(name);
-	kfree(link);
+	kfree(name);
 	return resolved;
 
  out_free:
-	__putname(name);
+	kfree(name);
 	return ERR_PTR(n);
 }