Re: [syzbot] Fix use-after-free in udmabuf_create

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: Fix use-after-free in udmabuf_create
Author: nightu.pwn@xxxxxxxxx

please test file uaf in udmabuf_create

#syz test
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
0e1980c40b6e

--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -382,6 +382,7 @@ static long udmabuf_create(struct miscdevice *device,

                kfree(folios);
                fput(memfd);
+               memfd = NULL;
        }

        flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0;