Re: [PATCH 2/2] fs: remove the inode argument to ->d_real() method

Al Viro
2024-02-02T18:38:46Z

On Fri, Feb 02, 2024 at 06:27:32PM +0000, Al Viro wrote:

> Think what happens if you fetch ->len in state prior to
> rename and ->name - after. memcpy() from one memory object
> with length that matches another, UAF right there.

s/UAF/fairly easy oops/ - you can end up fetching past the end of
page that hosts kmalloc'ed object, and there's no promise that anything
will be mapped there. I really need more coffee...