lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 12 Aug 2020 05:15:18 +0100
From:   Al Viro <>
To:     Linus Torvalds <>
        syzbot <>
Subject: [PATCH] Re: KASAN: use-after-free Read in path_init (2)

On Tue, Aug 11, 2020 at 08:17:16PM -0700, syzbot wrote:
> Hello,
> syzbot found the following issue on:
> HEAD commit:    5631c5e0 Merge tag 'xfs-5.9-merge-7' of git://git.kernel.o..
> git tree:       upstream
> console output:
> kernel config:
> dashboard link:
> compiler:       gcc (GCC) 10.1.0-syz 20200507
> syz repro:

fix breakage in do_rmdir()

putname() should happen only after we'd *not* branched to
retry, same as it's done in do_unlinkat().

Fixes: e24ab0ef689d "fs: push the getname from do_rmdir into the callers"
Signed-off-by: Al Viro <>
diff --git a/fs/namei.c b/fs/namei.c
index fde8fe086c09..9fa10c614de7 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3770,11 +3770,11 @@ long do_rmdir(int dfd, struct filename *name)
-	putname(name);
 	if (retry_estale(error, lookup_flags)) {
 		lookup_flags |= LOOKUP_REVAL;
 		goto retry;
+	putname(name);
 	return error;

Powered by blists - more mailing lists