Messages in this thread Patch in this message | | | Subject | Re: [PATCH] vfs: fix possible use after free in finish_open() | From | Miklos Szeredi <> | Date | Tue, 26 Oct 2010 12:28:48 +0200 |
| |
Oops, broken patch. Here's the correct one.
---- Subject: vfs: fix possible use after free in finish_open()
From: Miklos Szeredi <mszeredi@suse.cz>
In finish_open() nd->path is used after nameidata_to_filp() already released it. Fix by acquiring a ref to nd->path and releasing after the last use.
Similar fix needed in do_last().
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> CC: stable@kernel.org --- fs/namei.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
Index: linux-2.6/fs/namei.c =================================================================== --- linux-2.6.orig/fs/namei.c 2010-10-26 11:29:16.000000000 +0200 +++ linux-2.6/fs/namei.c 2010-10-26 11:29:20.000000000 +0200 @@ -1549,11 +1549,16 @@ static struct file *finish_open(struct n error = mnt_want_write(nd->path.mnt); if (error) goto exit; + + /* nameidata_to_filp() puts nd->path */ + path_get(&nd->path); } error = may_open(&nd->path, acc_mode, open_flag); if (error) { - if (will_truncate) + if (will_truncate) { mnt_drop_write(nd->path.mnt); + path_put(&nd->path); + } goto exit; } filp = nameidata_to_filp(nd); @@ -1578,8 +1583,10 @@ static struct file *finish_open(struct n * because the filp has had a write taken * on its behalf. */ - if (will_truncate) + if (will_truncate) { mnt_drop_write(nd->path.mnt); + path_put(&nd->path); + } return filp; exit: @@ -1679,8 +1686,11 @@ static struct file *do_last(struct namei mnt_drop_write(nd->path.mnt); goto exit; } + /* nameidata_to_filp() puts nd->path */ + mntget(nd->path.mnt); filp = nameidata_to_filp(nd); mnt_drop_write(nd->path.mnt); + mntput(nd->path.mnt); if (!IS_ERR(filp)) { error = ima_file_check(filp, acc_mode); if (error) {
| |