Commit 24fb33d4 authored Aug 12, 2020 by Al Viro Committed by Linus Torvalds Aug 12, 2020

fix breakage in do_rmdir()



syzbot reported and bisected a use-after-free due to the recent init
cleanups.

The putname() should happen only after we'd *not* branched to retry,
same as it's done in do_unlinkat().

Reported-by:  <syzbot+bbeb1c88016c7db4aa24@syzkaller.appspotmail.com>
Fixes: e24ab0ef "fs: push the getname from do_rmdir into the callers"
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent fb893de3

fs/namei.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -3770,11 +3770,11 @@ exit2:
		mnt_drop_write(path.mnt);
		exit1:
		path_put(&path);
		putname(name);
		if (retry_estale(error, lookup_flags)) {
		lookup_flags \|= LOOKUP_REVAL;
		goto retry;
		}
		putname(name);
		return error;
		}

Admin message