kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/fs/overlayfs
History
Vasiliy Kovalev 4b49d939b5 ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up 
[ Upstream commit c84e125fff ]

The issue was caused by dput(upper) being called before
ovl_dentry_update_reval(), while upper->d_flags was still
accessed in ovl_dentry_remote().

Move dput(upper) after its last use to prevent use-after-free.

BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]
BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167

Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 ovl_dentry_remote fs/overlayfs/util.c:162 [inline]
 ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167
 ovl_link_up fs/overlayfs/copy_up.c:610 [inline]
 ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170
 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223
 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136
 vfs_rename+0xf84/0x20a0 fs/namei.c:4893
...
 </TASK>

Fixes: b07d5cc93e ("ovl: update of dentry revalidate flags after copy up")
Reported-by: syzbot+316db8a1191938280eb6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=316db8a1191938280eb6
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Link: https://lore.kernel.org/r/20250214215148.761147-1-kovalev@altlinux.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-03-13 12:50:55 +01:00
..
copy_up.c ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up 2025-03-13 12:50:55 +01:00
dir.c ovl: pass ofs to creation operations 2025-03-13 12:50:55 +01:00
export.c ovl: update of dentry revalidate flags after copy up 2023-07-23 13:47:10 +02:00
file.c ovl: fix incorrect fdput() on aio completion 2023-09-23 11:10:01 +02:00
inode.c ovl: use wrappers to all vfs_*xattr() calls 2025-03-13 12:50:55 +01:00
Kconfig docs: fix broken references to text files 2020-04-20 15:35:59 -06:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
namei.c ovl: use wrappers to all vfs_*xattr() calls 2025-03-13 12:50:55 +01:00
overlayfs.h ovl: pass ofs to creation operations 2025-03-13 12:50:55 +01:00
ovl_entry.h ovl: check type and offset of struct vfsmount in ovl_entry 2023-08-26 14:23:23 +02:00
readdir.c ovl: pass ofs to creation operations 2025-03-13 12:50:55 +01:00
super.c ovl: pass ofs to creation operations 2025-03-13 12:50:55 +01:00
util.c ovl: pass ofs to creation operations 2025-03-13 12:50:55 +01:00