Hi Paul, Yes, please go ahead and change the Signed-off-by to: Signed-off-by: Stanislav Fort <[email protected]>
Sorry for the slight delay and thanks for the quick review, testing, and for adding the Fixes tag. Best wishes, Stanislav Fort Aisle Research On Wednesday, September 3, 2025 at 6:16:59 PM UTC+3 Paul Moore wrote: > On Tue, Sep 2, 2025 at 2:52 PM Paul Moore <[email protected]> wrote: > > On Tue, Sep 2, 2025 at 2:50 PM Paul Moore <[email protected]> wrote: > > > On Tue, Sep 2, 2025 at 7:00 AM Stanislav Fort < > [email protected]> wrote: > > > > > > > > When a watch on dir=/ is combined with an fsnotify event for a > > > > single-character name directly under / (e.g., creating /a), an > > > > out-of-bounds read can occur in audit_compare_dname_path(). > > > > > > > > The helper parent_len() returns 1 for "/". In > audit_compare_dname_path(), > > > > when parentlen equals the full path length (1), the code sets p = > path + 1 > > > > and pathlen = 1 - 1 = 0. The subsequent loop then dereferences > > > > p[pathlen - 1] (i.e., p[-1]), causing an out-of-bounds read. > > > > > > > > Fix this by adding a pathlen > 0 check to the while loop condition > > > > to prevent the out-of-bounds access. > > > > > > > > Reported-by: Stanislav Fort <[email protected]> > > > > Suggested-by: Linus Torvalds <[email protected]> > > > > Signed-off-by: Stanislav Fort <[email protected]> > > > > I also just noticed a disconnect on the email address. I can leave > > the Reported-by email as disclosure@, but do you mind if I convert > > your Signed-off-by email to stanislav.fort@? > > Stanislav, are you okay with changing your sign-off email to > [email protected]? > > -- > paul-moore.com >
