github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

vfs-7.2-rc1.kfunc

Browse Source 
Please consider pulling these changes from the signed vfs-7.2-rc1.kfunc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKQAKCRCRxhvAZXjc
 omvOAP4qC9EOcysoY0JGOEa4d915tpxYW6mxgv/My1MAMEybsQD+KHMNTiWke4Aj
 CSFyVhZ43R2I+VYO2HTPbzEGOTqs2Qs=
 =WfNh
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.kfunc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull bpf filesystem kfunc fix from Christian Brauner:
 "The bpf_set_dentry_xattr() and bpf_remove_dentry_xattr() kfuncs locked
  the inode of the supplied dentry without checking whether the dentry
  is negative.

  Passing a negative dentry (e.g., from security_inode_create) caused a
  NULL pointer dereference. Negative dentries now fail with EINVAL. The
  WARN_ON(!inode) in the bpf xattr permission helpers is dropped as well
  since it could be triggered the same way, amounting to a denial of
  service on systems with panic_on_warn enabled"

* tag 'vfs-7.2-rc1.kfunc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries
This commit is contained in:
Linus Torvalds 2026-06-15 02:34:37 +05:30
commit d2cb5e633c
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/bpf_fs_kfuncs.c
View File

@ -100,7 +100,7 @@ static bool match_security_bpf_prefix(const char *name__str)
static int bpf_xattr_read_permission(const char *name, struct inode *inode)
{
if (WARN_ON(!inode))
if (!inode)
return -EINVAL;
/* Allow reading xattr with user. and security.bpf. prefix */
@ -170,7 +170,7 @@ __bpf_kfunc_end_defs();
static int bpf_xattr_write_permission(const char *name, struct inode *inode)
{
if (WARN_ON(!inode))
if (!inode)
return -EINVAL;
/* Only allow setting and removing security.bpf. xattrs */
@ -289,6 +289,9 @@ __bpf_kfunc int bpf_set_dentry_xattr(struct dentry *dentry, const char *name__st
struct inode *inode = d_inode(dentry);
int ret;
if (!inode)
return -EINVAL;
inode_lock(inode);
ret = bpf_set_dentry_xattr_locked(dentry, name__str, value_p, flags);
inode_unlock(inode);
@ -314,6 +317,9 @@ __bpf_kfunc int bpf_remove_dentry_xattr(struct dentry *dentry, const char *name_
struct inode *inode = d_inode(dentry);
int ret;
if (!inode)
return -EINVAL;
inode_lock(inode);
ret = bpf_remove_dentry_xattr_locked(dentry, name__str);
inode_unlock(inode);