Commit 0c33037c authored by Amir Goldstein's avatar Amir Goldstein Committed by Linus Torvalds
Browse files

ovl: fix file leak in ovl_real_fdget_meta() 



ovl_open_realfile() is wrongly called twice after conversion to
new struct fd.

Fixes: 88a2f646 ("struct fd: representation change")
Reported-by: default avatar <syzbot+d9efec94dcbfa0de1c07@syzkaller.appspotmail.com>
Signed-off-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 34e1a5d4

fs/overlayfs/file.c

+1 −1
Original line number Diff line number Diff line
@@ -117,7 +117,7 @@ static int ovl_real_fdget_meta(const struct file *file, struct fd *real, 
		struct file *f = ovl_open_realfile(file, &realpath);

		if (IS_ERR(f))

			return PTR_ERR(f);

		real->word = (unsigned long)ovl_open_realfile(file, &realpath) | FDPUT_FPUT;

		real->word = (unsigned long)f | FDPUT_FPUT;

		return 0;

	}