diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2023-10-19 09:37:41 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2023-10-19 09:37:41 -0700 |
| commit | ea1cc20cd4ce55dd920a87a317c43da03ccea192 (patch) | |
| tree | 0c4d0adc1c19ffe73eec0f387fb0ab80d8e16eaf /kernel | |
| parent | f69d00d12fcee9ce4b4f24bf609ad7398d10a576 (diff) | |
| parent | 03adc61edad49e1bbecfb53f7ea5d78f398fe368 (diff) | |
| download | linux-stable-ea1cc20cd4ce55dd920a87a317c43da03ccea192.tar.gz linux-stable-ea1cc20cd4ce55dd920a87a317c43da03ccea192.tar.bz2 linux-stable-ea1cc20cd4ce55dd920a87a317c43da03ccea192.zip | |
Merge tag 'v6.6-rc7.vfs.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fix from Christian Brauner:
"An openat() call from io_uring triggering an audit call can apparently
cause the refcount of struct filename to be incremented from multiple
threads concurrently during async execution, triggering a refcount
underflow and hitting a BUG_ON(). That bug has been lurking around
since at least v5.16 apparently.
Switch to an atomic counter to fix that. The underflow check is
downgraded from a BUG_ON() to a WARN_ON_ONCE() but we could easily
remove that check altogether tbh"
* tag 'v6.6-rc7.vfs.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
audit,io_uring: io_uring openat triggers audit reference count underflow
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/auditsc.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 21d2fa815e78..6f0d6fb6523f 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2212,7 +2212,7 @@ __audit_reusename(const __user char *uptr) if (!n->name) continue; if (n->name->uptr == uptr) { - n->name->refcnt++; + atomic_inc(&n->name->refcnt); return n->name; } } @@ -2241,7 +2241,7 @@ void __audit_getname(struct filename *name) n->name = name; n->name_len = AUDIT_NAME_FULL; name->aname = n; - name->refcnt++; + atomic_inc(&name->refcnt); } static inline int audit_copy_fcaps(struct audit_names *name, @@ -2373,7 +2373,7 @@ out_alloc: return; if (name) { n->name = name; - name->refcnt++; + atomic_inc(&name->refcnt); } out: @@ -2500,7 +2500,7 @@ void __audit_inode_child(struct inode *parent, if (found_parent) { found_child->name = found_parent->name; found_child->name_len = AUDIT_NAME_FULL; - found_child->name->refcnt++; + atomic_inc(&found_child->name->refcnt); } } |