lkml.org 
[lkml]   [2009]   [Oct]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[4/8] eCryptfs: Prevent lower dentry from going negative during unlink (CVE-2009-2908)
    From

    From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>

    commit 9c2d2056647790c5034d722bd24e9d913ebca73c upstream.

    When calling vfs_unlink() on the lower dentry, d_delete() turns the
    dentry into a negative dentry when the d_count is 1. This eventually
    caused a NULL pointer deref when a read() or write() was done and the
    negative dentry's d_inode was dereferenced in
    ecryptfs_read_update_atime() or ecryptfs_getxattr().

    Placing mutt's tmpdir in an eCryptfs mount is what initially triggered
    the oops and I was able to reproduce it with the following sequence:

    open("/tmp/upper/foo", O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW, 0600) = 3
    link("/tmp/upper/foo", "/tmp/upper/bar") = 0
    unlink("/tmp/upper/foo") = 0
    open("/tmp/upper/bar", O_RDWR|O_CREAT|O_NOFOLLOW, 0600) = 4
    unlink("/tmp/upper/bar") = 0
    write(4, "eCryptfs test\n"..., 14 <unfinished ...>
    +++ killed by SIGKILL +++

    https://bugs.launchpad.net/ecryptfs/+bug/387073

    Reported-by: Loïc Minier <loic.minier@canonical.com>
    Cc: Serge Hallyn <serue@us.ibm.com>
    Cc: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
    Cc: ecryptfs-devel@lists.launchpad.net
    Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
    Cc: Chuck Ebbert <cebbert@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/ecryptfs/inode.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/fs/ecryptfs/inode.c
    +++ b/fs/ecryptfs/inode.c
    @@ -443,6 +443,7 @@ static int ecryptfs_unlink(struct inode
    struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
    struct dentry *lower_dir_dentry;

    + dget(lower_dentry);
    lower_dir_dentry = lock_parent(lower_dentry);
    rc = vfs_unlink(lower_dir_inode, lower_dentry);
    if (rc) {
    @@ -456,6 +457,7 @@ static int ecryptfs_unlink(struct inode
    d_drop(dentry);
    out_unlock:
    unlock_dir(lower_dir_dentry);
    + dput(lower_dentry);
    return rc;
    }


    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2009-10-10 01:45    [W:0.035 / U:59.556 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site