Unverified Commit 00d4899f authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15671 ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yifan Qiao <qiaoyifan4@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/MEI5DQFQYNWQSCF56GNOA23QZJYU76XR/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBWVT6 
 
Link:https://gitee.com/openeuler/kernel/pulls/15671

 

Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents 2d7a642a d0dac754

fs/overlayfs/copy_up.c

+1 −1
Original line number Diff line number Diff line
@@ -469,7 +469,6 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) 
	err = PTR_ERR(upper);

	if (!IS_ERR(upper)) {

		err = ovl_do_link(ovl_dentry_upper(c->dentry), udir, upper);

		dput(upper);



		if (!err) {

			/* Restore timestamps on parent (best effort) */
@@ -477,6 +476,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) 
			ovl_dentry_set_upper_alias(c->dentry);

			ovl_dentry_update_reval(c->dentry, upper);

		}

		dput(upper);

	}

	inode_unlock(udir);

	if (err)