On Tue, Sep 2, 2025 at 2:52 PM Paul Moore <[email protected]> wrote: > On Tue, Sep 2, 2025 at 2:50 PM Paul Moore <[email protected]> wrote: > > On Tue, Sep 2, 2025 at 7:00 AM Stanislav Fort <[email protected]> > > wrote: > > > > > > When a watch on dir=/ is combined with an fsnotify event for a > > > single-character name directly under / (e.g., creating /a), an > > > out-of-bounds read can occur in audit_compare_dname_path(). > > > > > > The helper parent_len() returns 1 for "/". In audit_compare_dname_path(), > > > when parentlen equals the full path length (1), the code sets p = path + 1 > > > and pathlen = 1 - 1 = 0. The subsequent loop then dereferences > > > p[pathlen - 1] (i.e., p[-1]), causing an out-of-bounds read. > > > > > > Fix this by adding a pathlen > 0 check to the while loop condition > > > to prevent the out-of-bounds access. > > > > > > Reported-by: Stanislav Fort <[email protected]> > > > Suggested-by: Linus Torvalds <[email protected]> > > > Signed-off-by: Stanislav Fort <[email protected]> > > I also just noticed a disconnect on the email address. I can leave > the Reported-by email as disclosure@, but do you mind if I convert > your Signed-off-by email to stanislav.fort@?
Stanislav, are you okay with changing your sign-off email to [email protected]? -- paul-moore.com
