From: Edward Adam Davis Date: Thu, 4 Dec 2025 13:16:22 +0000 (+0800) Subject: mqueue: correct the type of ro to int X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8cf01d0c4372ef5777d20c3c3a83936fd1c670f8;p=thirdparty%2Fkernel%2Flinux.git mqueue: correct the type of ro to int The ro variable, being of type bool, caused the -EROFS return value from mnt_want_write() to be implicitly converted to 1. This prevented the file from being correctly acquired, thus triggering the issue reported by syzbot [1]. Changing the type of ro to int allows the system to correctly identify the reason for the file open failure. [1] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] Call Trace: do_mq_open+0x5a0/0x770 ipc/mqueue.c:932 __do_sys_mq_open ipc/mqueue.c:945 [inline] __se_sys_mq_open ipc/mqueue.c:938 [inline] __x64_sys_mq_open+0x16a/0x1c0 ipc/mqueue.c:938 Fixes: f2573685bd0c ("ipc: convert do_mq_open() to FD_ADD()") Reported-by: syzbot+40f42779048f7476e2e0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=40f42779048f7476e2e0 Tested-by: syzbot+40f42779048f7476e2e0@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Link: https://patch.msgid.link/tencent_369728EA76ED36CD98793A6D942C956C4C0A@qq.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner --- diff --git a/ipc/mqueue.c b/ipc/mqueue.c index 56e811f9e5fa3..90664d26ec079 100644 --- a/ipc/mqueue.c +++ b/ipc/mqueue.c @@ -893,7 +893,7 @@ static int prepare_open(struct dentry *dentry, int oflag, int ro, } static struct file *mqueue_file_open(struct filename *name, - struct vfsmount *mnt, int oflag, bool ro, + struct vfsmount *mnt, int oflag, int ro, umode_t mode, struct mq_attr *attr) { struct dentry *dentry;