diff options
| author | Amir Goldstein <amir73il@gmail.com> | 2026-09-21 12:40:13 +0200 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-09-25 15:52:26 +0200 |
| commit | ae146bc1abdeb4607abf2975b858c053024e8ac1 (patch) | |
| tree | 4c722a805ae2e7c1636d8c0182eb14b2f008a621 /tools/perf/scripts/python/bin | |
| parent | 2d2a2d7aa98741b58f54cacc99b52024e4d865f9 (diff) | |
| download | linux-next-ae146bc1abdeb4607abf2975b858c053024e8ac1.tar.gz linux-next-ae146bc1abdeb4607abf2975b858c053024e8ac1.zip | |
ovl: fix UAF in ovl_do_mkdir() debug print
ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir().
Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on
failure."), vfs_mkdir() calls end_creating() on the input dentry on
failure and may replace it on success, so the post-call %pd can
use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.
Print the dentry before the call and only the result afterward.
Reported-by: syzbot+ced26b784bf977d223dd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ced26b784bf977d223dd
Fixes: fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure.")
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://patch.msgid.link/20260921104013.40475-1-amir73il@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/bin')
0 files changed, 0 insertions, 0 deletions