niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity
linux/fs/overlayfs
History
Exact
Vasiliy Kovalev c84e125fff
ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up 
The issue was caused by dput(upper) being called before
ovl_dentry_update_reval(), while upper->d_flags was still
accessed in ovl_dentry_remote().

Move dput(upper) after its last use to prevent use-after-free.

BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]
BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167

Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 ovl_dentry_remote fs/overlayfs/util.c:162 [inline]
 ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167
 ovl_link_up fs/overlayfs/copy_up.c:610 [inline]
 ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170
 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223
 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136
 vfs_rename+0xf84/0x20a0 fs/namei.c:4893
...
 </TASK>

Fixes: b07d5cc93e ("ovl: update of dentry revalidate flags after copy up")
Reported-by: syzbot+316db8a1191938280eb6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=316db8a1191938280eb6
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Link: https://lore.kernel.org/r/20250214215148.761147-1-kovalev@altlinux.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-02-19 18:06:53 +01:00
..
copy_up.c ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up 2025-02-19 18:06:53 +01:00
dir.c tree-wide: s/revert_creds_light()/revert_creds()/g 2024-12-02 11:25:09 +01:00
export.c ovl: support encoding fid from inode with no alias 2025-01-06 15:43:55 +01:00
file.c ovl: convert ovl_real_fdget() callers to ovl_real_file() 2024-11-15 08:56:49 +01:00
inode.c overlayfs updates for 6.13 2024-11-22 20:55:42 -08:00
Kconfig fs: prepare for stackable filesystems backing file helpers 2023-12-23 16:35:08 +02:00
Makefile ovl: Move xattr support to new xattrs.c file 2023-10-31 00:12:59 +02:00
namei.c assorted stuff for this merge window 2025-02-01 15:07:56 -08:00
overlayfs.h ovl: pass realinode to ovl_encode_real_fh() instead of realdentry 2025-01-06 15:43:55 +01:00
ovl_entry.h ovl: mark xwhiteouts directory with overlay.opaque='x' 2024-01-23 12:39:48 +02:00
params.c ovl: specify layers via file descriptors 2024-10-14 16:31:16 +02:00
params.h ovl: store and show the user provided lowerdir mount option 2023-10-31 00:13:02 +02:00
readdir.c ovl: use wrapper ovl_revert_creds() 2024-11-11 10:45:04 +01:00
super.c Pass parent directory inode and expected name to ->d_revalidate() 2025-01-27 19:25:23 -05:00
util.c tree-wide: s/revert_creds_light()/revert_creds()/g 2024-12-02 11:25:09 +01:00
xattrs.c ovl: use wrapper ovl_revert_creds() 2024-11-11 10:45:04 +01:00