SeongJae Park 48998c1773 mm/damon/dbgfs: check if rm_contexts input is for a real context ... commit 1de09a7281 upstream. A user could write a name of a file under 'damon/' debugfs directory, which is not a user-created context, to 'rm_contexts' file. In the case, 'dbgfs_rm_context()' just assumes it's the valid DAMON context directory only if a file of the name exist. As a result, invalid memory access could happen as below. Fix the bug by checking if the given input is for a directory. This check can filter out non-context inputs because directories under 'damon/' debugfs directory can be created via only 'mk_contexts' file. This bug has found by syzbot[1]. [1] https://lore.kernel.org/damon/000000000000ede3ac05ec4abf8e@google.com/ Link: https://lkml.kernel.org/r/20221107165001.5717-2-sj@kernel.org Fixes: 75c1c2b53c ("mm/damon/dbgfs: support multiple contexts") Signed-off-by: SeongJae Park <sj@kernel.org> Reported-by: syzbot+6087eafb76a94c4ac9eb@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> [5.15.x] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-11-16 09:58:27 +01:00
..
Kconfig	mm/damon: add kunit tests	2021-09-08 11:50:25 -07:00
Makefile	mm/damon: implement a debugfs-based user space interface	2021-09-08 11:50:24 -07:00
core-test.h	mm/damon/core-test: fix wrong expectations for 'damon_split_regions_of()'	2021-10-28 17:18:55 -07:00
core.c	mm/damon/core: fix fake load reports due to uninterruptible sleeps	2021-12-14 10:57:11 +01:00
dbgfs-test.h	mm/damon: don't use strnlen() with known-bogus source length	2021-09-24 16:13:34 -07:00
dbgfs.c	mm/damon/dbgfs: check if rm_contexts input is for a real context	2022-11-16 09:58:27 +01:00
vaddr-test.h	mm/damon: add kunit tests	2021-09-08 11:50:25 -07:00
vaddr.c	mm/damon: validate if the pmd entry is present before accessing	2022-10-26 12:34:24 +02:00