lkml.org 
[lkml]   [2010]   [Jun]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: [PATCH 1/2] vfs: sanitize __d_path()
From
Date
Miklos Szeredi wrote:
> -extern char *__d_path(const struct path *path, struct path *root, char *, int);
> +extern int __d_path(const struct path *path, struct path *root, char **, int *);
Does somebody use buflen after returning from __d_path()?
If nobody uses, we can pass it as "int" rather than "int *".

> --- linux-2.6.orig/security/tomoyo/realpath.c 2010-05-27 12:13:46.000000000 +0200
> +++ linux-2.6/security/tomoyo/realpath.c 2010-05-27 12:13:48.000000000 +0200
Sorry. This hunk will not apply because I modified this part
in order to support longer pathnames.
http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=blob;f=security/tomoyo/realpath.c;h=153fa23a05ccd90a9ff3b90c02cefbd9e0cb9126;hb=006dacc8a64e91f6d47c52aec6a9d894e5f93eba
New hunk will look like below.
---
security/tomoyo/realpath.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)

--- security-testing-2.6.orig/security/tomoyo/realpath.c
+++ security-testing-2.6/security/tomoyo/realpath.c
@@ -94,6 +94,8 @@ char *tomoyo_realpath_from_path(struct p
return NULL;
is_dir = dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode);
while (1) {
+ int error;
+ int len;
struct path ns_root = { .mnt = NULL, .dentry = NULL };
char *pos;
buf_len <<= 1;
@@ -127,21 +129,24 @@ char *tomoyo_realpath_from_path(struct p
/* If we don't have a vfsmount, we can't calculate. */
if (!path->mnt)
break;
+ len = buflen - 1;
+ pos = buf + len;
+ *pos = '\0';
spin_lock(&dcache_lock);
/* go to whatever namespace root we are under */
- pos = __d_path(path, &ns_root, buf, buf_len);
+ error = __d_path(path, &ns_root, &pos, &len);
spin_unlock(&dcache_lock);
+ if (error)
+ continue;
/* Prepend "/proc" prefix if using internal proc vfs mount. */
- if (!IS_ERR(pos) && (path->mnt->mnt_flags & MNT_INTERNAL) &&
+ if ((path->mnt->mnt_flags & MNT_INTERNAL) &&
(path->mnt->mnt_sb->s_magic == PROC_SUPER_MAGIC)) {
pos -= 5;
if (pos >= buf)
memcpy(pos, "/proc", 5);
else
- pos = ERR_PTR(-ENOMEM);
+ continue;
}
- if (IS_ERR(pos))
- continue;
name = tomoyo_encode(pos);
break;
}

\
 
 \ /
  Last update: 2010-06-04 16:13    [W:0.039 / U:2.212 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site