github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-28 01:26:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
951d09ca45
linux/fs/overlayfs
History
Amir Goldstein ae146bc1ab
ovl: fix UAF in ovl_do_mkdir() debug print 
ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir().
Since commit fe497f0759 ("VFS: change vfs_mkdir() to unlock on
failure."), vfs_mkdir() calls end_creating() on the input dentry on
failure and may replace it on success, so the post-call %pd can
use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.

Print the dentry before the call and only the result afterward.

Reported-by: syzbot+ced26b784bf977d223dd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ced26b784bf977d223dd
Fixes: fe497f0759 ("VFS: change vfs_mkdir() to unlock on failure.")
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://patch.msgid.link/20260921104013.40475-1-amir73il@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-25 15:52:26 +02:00
..
copy_up.c ovl: use linked upper dentry in copy-up tmpfile 2026-07-01 15:26:24 +02:00
dir.c vfs-7.3-rc1.ovl 2026-08-17 13:38:36 -07:00
export.c vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
file.c ovl: check access to copy_file_range source with src mounter creds 2026-07-22 16:42:28 +02:00
inode.c vfs-7.3-rc1.ovl 2026-08-17 13:38:36 -07:00
Kconfig fs: prepare for stackable filesystems backing file helpers 2023-12-23 16:35:08 +02:00
Makefile ovl: Move xattr support to new xattrs.c file 2023-10-31 00:12:59 +02:00
namei.c treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
overlayfs.h ovl: fix UAF in ovl_do_mkdir() debug print 2026-09-25 15:52:26 +02:00
ovl_entry.h ovl: make fsync after metadata copy-up opt-in mount option 2026-03-27 12:48:10 +01:00
params.c ovl: make fsync after metadata copy-up opt-in mount option 2026-03-27 12:48:10 +01:00
params.h ovl: Prepare for mounting case-insensitive enabled layers 2025-09-23 12:29:35 +02:00
readdir.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
super.c ovl: return EINVAL instead of EIO in case of mismatched user_ns 2026-08-31 12:15:51 +02:00
util.c ovl: fix verity lazy-load guard broken by fsverity_active() semantic change 2026-05-06 08:37:30 -07:00
xattrs.c vfs-7.3-rc1.ovl 2026-08-17 13:38:36 -07:00