From: Al Viro <viro@zeniv.linux.org.uk> mainline inclusion from mainline-v6.13-rc1 commit a71874379ec8c6e788a61d71b3ad014a8d9a5c08 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13855 CVE: CVE-2024-14027 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Reviewed-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Conflicts: fs/xattr.c [mainline 88a2f6468d01 not applied] Signed-off-by: Yongjian Sun <sunyongjian1@huawei.com> --- fs/xattr.c | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-) diff --git a/fs/xattr.c b/fs/xattr.c index 7574d24b982e..44dffb1f90c5 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -810,16 +810,13 @@ SYSCALL_DEFINE4(lgetxattr, const char __user *, pathname, SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name, void __user *, value, size_t, size) { - struct fd f = fdget(fd); - ssize_t error = -EBADF; + CLASS(fd, f)(fd); if (!f.file) - return error; + return -EBADF; audit_file(f.file); - error = getxattr(file_mnt_idmap(f.file), f.file->f_path.dentry, + return getxattr(file_mnt_idmap(f.file), f.file->f_path.dentry, name, value, size); - fdput(f); - return error; } /* @@ -886,15 +883,12 @@ SYSCALL_DEFINE3(llistxattr, const char __user *, pathname, char __user *, list, SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size) { - struct fd f = fdget(fd); - ssize_t error = -EBADF; + CLASS(fd, f)(fd); if (!f.file) - return error; + return -EBADF; audit_file(f.file); - error = listxattr(f.file->f_path.dentry, list, size); - fdput(f); - return error; + return listxattr(f.file->f_path.dentry, list, size); } /* @@ -951,12 +945,12 @@ SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname, SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name) { - struct fd f = fdget(fd); + CLASS(fd, f)(fd); char kname[XATTR_NAME_MAX + 1]; - int error = -EBADF; + int error; if (!f.file) - return error; + return -EBADF; audit_file(f.file); error = strncpy_from_user(kname, name, sizeof(kname)); @@ -971,7 +965,6 @@ SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name) f.file->f_path.dentry, kname); mnt_drop_write_file(f.file); } - fdput(f); return error; } -- 2.39.2