Skip to content

Commit 6278b8c

Browse files
Lizhi XuNipaLocal
Lizhi Xu
authored and
NipaLocal
committed
fs/9p: fix uaf in in v9fs_stat2inode_dotl
The incorrect logical order of accessing the st object code in v9fs_fid_iget_dotl is causing this uaf. Fixes: 724a084 ("fs/9p: simplify iget to remove unnecessary paths") Reported-and-tested-by: syzbot+7a3d75905ea1a830dbe5@syzkaller.appspotmail.com Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com> Signed-off-by: NipaLocal <nipa@local>
1 parent 9b2d318 commit 6278b8c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

fs/9p/vfs_inode_dotl.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,11 +78,11 @@ struct inode *v9fs_fid_iget_dotl(struct super_block *sb, struct p9_fid *fid)
7878

7979
retval = v9fs_init_inode(v9ses, inode, &fid->qid,
8080
st->st_mode, new_decode_dev(st->st_rdev));
81+
v9fs_stat2inode_dotl(st, inode, 0);
8182
kfree(st);
8283
if (retval)
8384
goto error;
8485

85-
v9fs_stat2inode_dotl(st, inode, 0);
8686
v9fs_set_netfs_context(inode);
8787
v9fs_cache_inode_get_cookie(inode);
8888
retval = v9fs_get_acl(inode, fid);

0 commit comments

Comments
 (0)