]> Savannah Git Hosting - grub.git/commit
kern/file: Call grub_dl_unref() after fs->fs_close()
authorThomas Frauendorfer | Miray Software <tf@miray.de>
Wed, 7 May 2025 14:15:22 +0000 (16:15 +0200)
committerDaniel Kiper <daniel.kiper@oracle.com>
Tue, 18 Nov 2025 13:34:44 +0000 (14:34 +0100)
commitc4fb4cbc941981894a00ba8e75d634a41967a27f
tree6ae13967330c1c636a6969ac5661fb4f658123b8
parentcc9d621dd06bfa12eac511b37b4ceda5bd2f8246
kern/file: Call grub_dl_unref() after fs->fs_close()

With commit 16f196874 (kern/file: Implement filesystem reference
counting) files hold a reference to their file systems.

When closing a file in grub_file_close() we should not expect
file->fs to stay valid after calling grub_dl_unref() on file->fs->mod.
So, grub_dl_unref() should be called after file->fs->fs_close().

Fixes: CVE-2025-54771
Fixes: 16f196874 (kern/file: Implement filesystem reference counting)
Reported-by: Thomas Frauendorfer | Miray Software <tf@miray.de>
Signed-off-by: Thomas Frauendorfer | Miray Software <tf@miray.de>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
grub-core/kern/file.c