Add a check to avoid using an invalid pointer if ovl_open_realfile fails. #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c index 2b7a5a3a7a2f..67f75eeb1e51 100644 --- a/fs/overlayfs/file.c +++ b/fs/overlayfs/file.c @@ -117,7 +117,11 @@ static int ovl_real_fdget_meta(const struct file *file, struct fd *real, struct file *f = ovl_open_realfile(file, &realpath); if (IS_ERR(f)) return PTR_ERR(f); - real->word = (unsigned long)ovl_open_realfile(file, &realpath) | FDPUT_FPUT; + f = ovl_open_realfile(file, &realpath); + if (IS_ERR(f)) + return PTR_ERR(f); + real->word = (unsigned long)f; + real->word |= FDPUT_FPUT; return 0; }