redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull vfs fix from Al Viro:
 "Fix a use-after-free in do_last() handling of sysctl_protected_...
  checks.

  The use-after-free normally doesn't happen there, but race with
  rename() and it becomes possible"

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  do_last(): fetch directory ->i_mode and ->i_uid before it's too late
alistair/sunxi64-5.5-dsi
Linus Torvalds 2020-01-26 10:33:48 -08:00
parent a45ea48e2b d0cb50185a
commit b1b298914f
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
fs/namei.c
View File

@ -1001,7 +1001,8 @@ static int may_linkat(struct path *link)
* may_create_in_sticky - Check whether an O_CREAT open in a sticky directory * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
* should be allowed, or not, on files that already * should be allowed, or not, on files that already
* exist. * exist.
* @dir: the sticky parent directory * @dir_mode: mode bits of directory
* @dir_uid: owner of directory
* @inode: the inode of the file to open * @inode: the inode of the file to open
* *
* Block an O_CREAT open of a FIFO (or a regular file) when: * Block an O_CREAT open of a FIFO (or a regular file) when:
@ -1017,18 +1018,18 @@ static int may_linkat(struct path *link)
* *
* Returns 0 if the open is allowed, -ve on error. * Returns 0 if the open is allowed, -ve on error.
*/ */
static int may_create_in_sticky(struct dentry * const dir, static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,
struct inode * const inode) struct inode * const inode)
{ {
if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) || if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
(!sysctl_protected_regular && S_ISREG(inode->i_mode)) || (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
likely(!(dir->d_inode->i_mode & S_ISVTX)) || likely(!(dir_mode & S_ISVTX)) ||
uid_eq(inode->i_uid, dir->d_inode->i_uid) || uid_eq(inode->i_uid, dir_uid) ||
uid_eq(current_fsuid(), inode->i_uid)) uid_eq(current_fsuid(), inode->i_uid))
return 0; return 0;
if (likely(dir->d_inode->i_mode & 0002) || if (likely(dir_mode & 0002) ||
(dir->d_inode->i_mode & 0020 && (dir_mode & 0020 &&
((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) || ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
(sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) { (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
const char *operation = S_ISFIFO(inode->i_mode) ? const char *operation = S_ISFIFO(inode->i_mode) ?
@ -3201,6 +3202,8 @@ static int do_last(struct nameidata *nd,
struct file *file, const struct open_flags *op) struct file *file, const struct open_flags *op)
{ {
struct dentry *dir = nd->path.dentry; struct dentry *dir = nd->path.dentry;
kuid_t dir_uid = dir->d_inode->i_uid;
umode_t dir_mode = dir->d_inode->i_mode;
int open_flag = op->open_flag; int open_flag = op->open_flag;
bool will_truncate = (open_flag & O_TRUNC) != 0; bool will_truncate = (open_flag & O_TRUNC) != 0;
bool got_write = false; bool got_write = false;
@ -3331,7 +3334,7 @@ finish_open:
error = -EISDIR; error = -EISDIR;
if (d_is_dir(nd->path.dentry)) if (d_is_dir(nd->path.dentry))
goto out; goto out;
error = may_create_in_sticky(dir, error = may_create_in_sticky(dir_mode, dir_uid,
d_backing_inode(nd->path.dentry)); d_backing_inode(nd->path.dentry));
if (unlikely(error)) if (unlikely(error))
goto out; goto out;