Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/fs/overlayfs
History
Nirmoy Das 1711b6ed69
 ovl: keep err zero after successful ovl_cache_get() 
ovl_iterate_merged() stores PTR_ERR(cache) in err before checking
IS_ERR(cache). On success err holds the truncated cache pointer and
can be returned as a bogus non-zero error.

The syzbot reproducer reaches this through overlay-on-overlay readdir:

  getdents64
    iterate_dir(outer overlay file)
      ovl_iterate_merged()
        ovl_cache_get()
          ovl_dir_read_merged()
            ovl_dir_read()
              iterate_dir(inner overlay file)
                ovl_iterate_merged()

Only compute PTR_ERR(cache) on the error path.

Fixes: d25e4b739f ("ovl: refactor ovl_iterate() and port to cred guard")
Reported-by: syzbot+a16fb0cce329a320661c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a16fb0cce329a320661c
Cc: stable@vger.kernel.org
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Link: https://patch.msgid.link/20260514144258.3068715-1-nirmoyd@nvidia.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-05-18 14:56:15 +02:00
..
copy_up.c ovl: make fsync after metadata copy-up opt-in mount option 2026-03-27 12:48:10 +01:00
dir.c Fixing livelocks in shrink_dcache_tree() 2026-04-21 07:30:44 -07:00
export.c vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
file.c lsm: add backing_file LSM hooks 2026-04-03 16:53:50 -04:00
inode.c fs: add support for non-blocking timestamp updates 2026-01-12 14:01:33 +01:00
Kconfig
Makefile
namei.c treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
overlayfs.h vfs-7.1-rc1.directory 2026-04-13 10:24:33 -07:00
ovl_entry.h ovl: make fsync after metadata copy-up opt-in mount option 2026-03-27 12:48:10 +01:00
params.c ovl: make fsync after metadata copy-up opt-in mount option 2026-03-27 12:48:10 +01:00
params.h
readdir.c ovl: keep err zero after successful ovl_cache_get() 2026-05-18 14:56:15 +02:00
super.c vfs-7.1-rc1.directory 2026-04-13 10:24:33 -07:00
util.c ovl: fix verity lazy-load guard broken by fsverity_active() semantic change 2026-05-06 08:37:30 -07:00
xattrs.c ovl: port ovl_listxattr() to cred guard 2025-11-19 21:58:24 +01:00