On Mon, May 27, 2024 at 04:32:00PM +0200, Christian Brauner wrote:
> That smells like a UAF:
>
> dfd = open("/bla");
> fsconfig(FSCONFIG_SET_PATH, dfd, "blub", 0);
> close(dfd);
> umount("/bla");
>
> and that result->ptr now has a dangling pointer which will be triggered by:
>
> fsconfig(FSCONFIG_CMD_CREATE);
Yeah. Also the whole path thing is entirely unused. The best thing
to do about it is to remove it, we can always resurrect if if/when we
actually need it.
