mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
1de09a7281
A user could write a name of a file under 'damon/' debugfs directory,
which is not a user-created context, to 'rm_contexts' file. In the case,
'dbgfs_rm_context()' just assumes it's the valid DAMON context directory
only if a file of the name exist. As a result, invalid memory access
could happen as below. Fix the bug by checking if the given input is for
a directory. This check can filter out non-context inputs because
directories under 'damon/' debugfs directory can be created via only
'mk_contexts' file.
This bug has found by syzbot[1].
[1] https://lore.kernel.org/damon/000000000000ede3ac05ec4abf8e@google.com/
Link: https://lkml.kernel.org/r/20221107165001.5717-2-sj@kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| core-test.h | ||
| core.c | ||
| dbgfs-test.h | ||
| dbgfs.c | ||
| Kconfig | ||
| lru_sort.c | ||
| Makefile | ||
| modules-common.h | ||
| ops-common.c | ||
| ops-common.h | ||
| paddr.c | ||
| reclaim.c | ||
| sysfs.c | ||
| vaddr-test.h | ||
| vaddr.c | ||