On Thu, Oct 25, 2018 at 2:44 PM, Miklos Szeredi <miklos@xxxxxxxxxx> wrote:
>> + temp = ovl_create_temp(c->workdir, &cattr);
>> +out:
>> + if (new_creds) {
>> + revert_creds(old_creds);
>
> Not new in this patch, but it looks like this will Oops if old_creds
> is NULL, which happens if security_inode_copy_up() returns an error.
>
> Trivial to fix, but I'm not sure we need the put_cred(new_creds) in
> the failed security_inode_copy_up() case. Vivek, do you remember the
> reason for this error cleanup?
Answering myself: this bug was introduced by a cleanup patch by me:
7d90b853f932 ("ovl: extract helper to get temp file in copy up")
and so the put_cred() isn't needed in this case at all.
Will do a separate fix.
Thanks,
Miklos
