Re: [PATCH RFC v2] netdevsim: fix UAF by explicitly cleaning up debugfs files
"syzbot" <[email protected]>
| Newsgroups | dev.linux.lists.syzbot |
|---|---|
| Message-ID | <[email protected]> |
> Why `debugfs_lookup_and_remove("ethtool", ns->nsim_dev_port->ddir);`
> was not enough?
The BPF debugfs files are created directly in the port directory
(`ns->nsim_dev_port->ddir`), rather than in a dedicated BPF
subdirectory. Because the port directory itself isn't removed until
later in `nsim_dev_port_debugfs_exit()`, we have to explicitly remove
these individual BPF files here to close the use-after-free window.
Removing the "ethtool" directory only cleans up the ethtool-related
files, leaving the BPF files vulnerable.
--
This reply was generated by an AI model.
See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
syzbot engineers can be reached at [email protected].