From nobody Sat Feb 7 18:15:23 2026 Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3D409357A4B for ; Wed, 24 Dec 2025 14:37:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766587080; cv=none; b=OEvwyHVFFUctYb7QfOExnaXYP6MPlDkLiItkjcOxTfy6h341wyi8GWAHukYBQOrY2sl2DBFu1BPsj2tssWGYIpavEejzD02n0Q29IIXsG0nS1HAru5VQ8anerKl1HQqd27hq8Y9FLYipGNPmFFHseDDjIf1JwiJUH8/oxKBFe/c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766587080; c=relaxed/simple; bh=QXBCkMKncjbVvgYao5NtYW1W28f7FkMdaqdlELJMfRc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=t4reZCZ1bItLkTnpju8x0X1i2TjrFlpjmXkFNrU1pVsUW6AydSDsYAAdrPQgzvzTssstGhwymdlNf6oeF67hUkcgnTi5cYzib6G7RRDyNN1BfS5AAr8riGRm3JvKV91GG0RWJ6dUcsduTgviHVcVAi8NrtFYjORpDK40147F/pg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AUNh3e//; arc=none smtp.client-ip=209.85.210.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AUNh3e//" Received: by mail-pf1-f175.google.com with SMTP id d2e1a72fcca58-7b80fed1505so6279337b3a.3 for ; Wed, 24 Dec 2025 06:37:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766587077; x=1767191877; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=z7viBrygQfBJ9dsJSYJ1JbTPrbjesC9vR0UO5lc+/GI=; b=AUNh3e//5hbRJov5opjPiQVCRFGrnznny8eBFBEbYHAh+Kt3CUvazIPX5pN602iPEz Vhriz6KzERoJkit0s7fAyEMY8WqR3OublK4MksfBKH7Oq7WclUoaODm8C1tJufuvcokI XgBQBjxlGHK8EHU50R4n58n7FviBsC64hXbDwZC/iKXHSYvLXSM/U3hocPkPmqmeaunL sRh30rqMXU3Tbt2PR8utcMu02RpB0ofCsfbZbQeIGc+v7awD2nfhoT/pvNh/Doue+1D9 lDUj69sgacWo5VtYOH0McDZHiTquujk2Kb+rRrCXa/q1HzI9XiCu0Buk+fbPX1Otp0vX 3hIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766587077; x=1767191877; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=z7viBrygQfBJ9dsJSYJ1JbTPrbjesC9vR0UO5lc+/GI=; b=CVGY2dMZJbRFPxekcl9jMhykERpxCltlUBUABdh8JfPqAloYRmtYgjmIZVhtq5jYj+ z7Zztp5Ij7oQzBNIW0iXT9dlONmoABj1UATWzep1Arhv09VOALjbf5GzMRT31/QfRqbO 9p4e+qi5dL2AWqx3CjuC8WvOSXB8Ai16RPmABzZ1Tot5MCdkeASx6FSThxK8b0UUeGYJ 8bhDxrc4T051G1oMc+oY8uVP2Sk7AZ0GDcLFovIW70TFzP8shmL0iH2cMvlHgfhswmG+ mdRPtkLMfOIlap0uNZG3yNLRNvFpBJqJGEkxbm/OtfnqfSxmI6r8FeX5sTnhYtVshbLp 6j4g== X-Forwarded-Encrypted: i=1; AJvYcCV7607JXts1SskC5mcQsImk97/RZ4GsXY6/9hK99vMwypqY2wJo6H5aN30mdXabMkB+dUab3DNA7yHC2do=@vger.kernel.org X-Gm-Message-State: AOJu0YyGzYWXdfCvF81AOTEEFf2tXwyUZ+39KEAqCo0/cIpIx/SMxfuE NYZz1CxEOQ3WCHGuZtC8p8/NzbFJ9ogUz7AZvPYByKviKo9hgWhFe5RS X-Gm-Gg: AY/fxX58yhRDec+Gj8NxWwAL/fMTYMt8nswmjZU3JHqVf2uigYlT2XUK/TgmI2ut2jf 7jHm/Gx5GspTsWkDaHN/b7dLS0iTGmMB7AqmmD93PpCXSnGK0p6gBq4l4m2EuhcYtYMOmgb/ZNr 9CI19LGvBRx/uzyutIJX88v+Rn1cbsgmWDEZfLobKnB6qRV18PkrHS0d4b5vCQYNLLKj9PYZBuy +KSUD7OekgBQFz242yqRfJqfO4ZXt+A4T7A3rrI1Z9dfKcxyqnUyvElGr9Z5gODnbAe9VJZnHZE PKklKuJ2+ZpttvUs+gNngAcm8z/9+1JHBrIyjeoLv7SLIos2zl0C4Cdka3r6I4FQBoBUAEk+/OR tVZiS/H76DjvS6oCToyEob/ODD6baXdDf1J+5mPcKlYGlL0tV+g377BSgTqYD2UgcRt6Xp59+n2 LJGqMWGNLes7jAZCqb6BGrrnhuIZuN X-Google-Smtp-Source: AGHT+IEf6OnhraAPlEJvOzxSDGd+A4+uIZDVV4h7OLSgrckMixR5lFY+H3H+PtcPc58QuGkNN61Ecg== X-Received: by 2002:a05:6a20:9149:b0:35d:2984:e5fd with SMTP id adf61e73a8af0-376a8eb2ab9mr14055823637.32.1766587077446; Wed, 24 Dec 2025 06:37:57 -0800 (PST) Received: from localhost.localdomain ([111.125.235.126]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c1e79a17fdesm14972689a12.8.2025.12.24.06.37.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 24 Dec 2025 06:37:57 -0800 (PST) From: Prithvi Tambewagh To: syzbot+00e61c43eb5e4740438f@syzkaller.appspotmail.com, brauner@kernel.org, jack@suse.cz, viro@zeniv.linux.org.uk Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Prithvi Tambewagh Subject: [PATCH] io_uring: Fix filename leak in __io_openat_prep Date: Wed, 24 Dec 2025 20:07:48 +0530 Message-Id: <20251224143748.45491-1-activprithvi@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <694bcb49.050a0220.35954c.001a.GAE@google.com> References: <694bcb49.050a0220.35954c.001a.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" #syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git = b927546677c876e26eba308550207c2ddf812a43 Signed-off-by: Prithvi Tambewagh Reported-by: syzbot+00e61c43eb5e4740438f@syzkaller.appspotmail.com Tested-by: syzbot+00e61c43eb5e4740438f@syzkaller.appspotmail.com --- io_uring/openclose.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/io_uring/openclose.c b/io_uring/openclose.c index bfeb91b31bba..fc190a3d8112 100644 --- a/io_uring/openclose.c +++ b/io_uring/openclose.c @@ -75,8 +75,11 @@ static int __io_openat_prep(struct io_kiocb *req, const = struct io_uring_sqe *sqe } =20 open->file_slot =3D READ_ONCE(sqe->file_index); - if (open->file_slot && (open->how.flags & O_CLOEXEC)) + if (open->file_slot && (open->how.flags & O_CLOEXEC)) { + putname(open->filename); + open->filename =3D NULL; return -EINVAL; + } =20 open->nofile =3D rlimit(RLIMIT_NOFILE); req->flags |=3D REQ_F_NEED_CLEANUP; base-commit: b927546677c876e26eba308550207c2ddf812a43 --=20 2.34.1