Commit 3525be83 authored by Vasiliy Kovalev's avatar Vasiliy Kovalev Committed by Yifan Qiao
Browse files

ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up 

mainline inclusion
from mainline-v6.14-rc5
commit c84e125fff2615b4d9c259e762596134eddd2f27
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVT6
CVE: CVE-2025-21887

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c84e125fff2615b4d9c259e762596134eddd2f27



--------------------------------

The issue was caused by dput(upper) being called before
ovl_dentry_update_reval(), while upper->d_flags was still
accessed in ovl_dentry_remote().

Move dput(upper) after its last use to prevent use-after-free.

BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]
BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167

Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 ovl_dentry_remote fs/overlayfs/util.c:162 [inline]
 ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167
 ovl_link_up fs/overlayfs/copy_up.c:610 [inline]
 ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170
 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223
 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136
 vfs_rename+0xf84/0x20a0 fs/namei.c:4893
...
 </TASK>

Fixes: b07d5cc9 ("ovl: update of dentry revalidate flags after copy up")
Reported-by: default avatar <syzbot+316db8a1191938280eb6@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=316db8a1191938280eb6


Signed-off-by: default avatarVasiliy Kovalev <kovalev@altlinux.org>
Link: https://lore.kernel.org/r/20250214215148.761147-1-kovalev@altlinux.org


Reviewed-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
Signed-off-by: default avatarYifan Qiao <qiaoyifan4@huawei.com>
parent b28aab59

fs/overlayfs/copy_up.c

+1 −1
Original line number Diff line number Diff line
@@ -570,7 +570,6 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) 
	err = PTR_ERR(upper);

	if (!IS_ERR(upper)) {

		err = ovl_do_link(ofs, ovl_dentry_upper(c->dentry), udir, upper);

		dput(upper);



		if (!err) {

			/* Restore timestamps on parent (best effort) */
@@ -578,6 +577,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) 
			ovl_dentry_set_upper_alias(c->dentry);

			ovl_dentry_update_reval(c->dentry, upper);

		}

		dput(upper);

	}

	inode_unlock(udir);

	if (err)