diff options
| author |   Amir Goldstein <amir73il@gmail.com> | 2024-09-27 13:54:23 +0200 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@linux-foundation.org> | 2024-09-27 12:38:47 -0700 |
| commit | 0c33037c825e47f64f426999db7192604e6d3188 (patch) | |
| tree | fe1643fe3d6162d42c7883c812121d9a56c6a38f | |
| parent | Merge tag 'random-6.12-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random (diff) | |
| download | wireguard-linux-0c33037c825e47f64f426999db7192604e6d3188.tar.xz wireguard-linux-0c33037c825e47f64f426999db7192604e6d3188.zip | |
ovl: fix file leak in ovl_real_fdget_meta()
ovl_open_realfile() is wrongly called twice after conversion to
new struct fd.
Fixes: 88a2f6468d01 ("struct fd: representation change")
Reported-by: syzbot+d9efec94dcbfa0de1c07@syzkaller.appspotmail.com
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to '')
| -rw-r--r-- | fs/overlayfs/file.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c index 2b7a5a3a7a2f..4504493b20be 100644 --- a/fs/overlayfs/file.c +++ b/fs/overlayfs/file.c @@ -117,7 +117,7 @@ static int ovl_real_fdget_meta(const struct file *file, struct fd *real, struct file *f = ovl_open_realfile(file, &realpath); if (IS_ERR(f)) return PTR_ERR(f); - real->word = (unsigned long)ovl_open_realfile(file, &realpath) | FDPUT_FPUT; + real->word = (unsigned long)f | FDPUT_FPUT; return 0; } |