From: Vasiliy Kovalev kovalev@altlinux.org

mainline inclusion from mainline-v6.13-rc1 commit c8b359dddb418c60df1a69beea01d1b3322bfe83 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAML CVE: CVE-2024-56570

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

--------------------------------

Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack.

Reported-by: syzbot+a8c9d476508bd14a90e5@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=a8c9d476508bd14a90e5 Suggested-by: Miklos Szeredi miklos@szeredi.hu Link: https://lore.kernel.org/linux-unionfs/CAJfpegvx-oS9XGuwpJx=Xe28_jzWx5eRo1y90... Signed-off-by: Vasiliy Kovalev kovalev@altlinux.org Cc: stable@vger.kernel.org Signed-off-by: Amir Goldstein amir73il@gmail.com Signed-off-by: Zizhi Wo wozizhi@huawei.com --- fs/overlayfs/util.c | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c index 06ca98f88983..3b6584a180c6 100644 --- a/fs/overlayfs/util.c +++ b/fs/overlayfs/util.c @@ -102,6 +102,9 @@ bool ovl_dentry_remote(struct dentry *dentry)

bool ovl_dentry_weird(struct dentry *dentry) { + if (!d_can_lookup(dentry) && !d_is_file(dentry) && !d_is_symlink(dentry)) + return true; + return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT | DCACHE_MANAGE_TRANSIT | DCACHE_OP_HASH |