Re: [syzbot] Re: [syzbot] [squashfs?] VFS: Close: file count is zero (use-after-free)

syzbot
2024-06-03T06:19:47Z

linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [squashfs?] VFS: Close: file count is zero (use-after-free)
Author: nightu.pwn@gmail.com

please test file uaf in udmabuf_create

#syz test

---
drivers/dma-buf/udmabuf.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index afa8bfd2a2a9..53035c601e92 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -382,6 +382,7 @@ static long udmabuf_create(struct miscdevice *device,

kfree(folios);
fput(memfd);
+ memfd = NULL;
}

flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0;
--