Unverified Commit a5961b64 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15672 ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yifan Qiao <qiaoyifan4@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/GSA4UR3PYDWHRSPEPX6DWGM3E4FAVRZC/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBWVT6 
 
Link:https://gitee.com/openeuler/kernel/pulls/15672

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 7d73dffa 3525be83

fs/overlayfs/copy_up.c

+1 −1
Original line number Diff line number Diff line
@@ -570,7 +570,6 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) 
	err = PTR_ERR(upper);

	if (!IS_ERR(upper)) {

		err = ovl_do_link(ofs, ovl_dentry_upper(c->dentry), udir, upper);

		dput(upper);



		if (!err) {

			/* Restore timestamps on parent (best effort) */
@@ -578,6 +577,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) 
			ovl_dentry_set_upper_alias(c->dentry);

			ovl_dentry_update_reval(c->dentry, upper);

		}

		dput(upper);

	}

	inode_unlock(udir);

	if (err)