lkml.org 
[lkml]   [2010]   [Feb]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] vfs: Fix use-after-free of vfsmount by mnt_drop_write()
Date
Valerie Aurora <vaurora@redhat.com> writes:

>> Those might be assuming that the nd->path.mnt refcnt is keeped by
>> filp after nameidata_to_filp().
>>
>> It's wrong if nameidata_to_filp() returned the error. (nd->path and
>> filp are invalid)
>>
>> Instead to use deep knowledge of nameidata_to_filp() internal, this
>> thinks the nd->path is invalid after nameidata_to_filp(). So, this
>> just take refcnt for mnt_want/drop_write().
>
> You might take a look at the patch I just posted:
>
> Subject: [RFC PATCH] VFS: Simplify truncate logic in do_filp_open()
>
> If that patch is correct, it will considerably simplify the second
> part of your patch.

[...]
>> /*
>> - * It is now safe to drop the mnt write
>> - * because the filp has had a write taken
>> - * on its behalf.
>> + * It is now safe to drop the mnt write because the filp has
>> + * had a write taken on its behalf. (NOTE: since O_TRUNC can
>> + * be used with O_RDONLY, this needs to cover truncate path)
>> */
>> - if (will_truncate)
>> - mnt_drop_write(nd.path.mnt);
>> + if (will_truncate) {
>> + mnt_drop_write(mnt_writer);
>> + mntput(mnt_writer);
>> + }

Unfortunately, no. I already noted that we can't it simply. ;)

Thanks.
--
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>


\
 
 \ /
  Last update: 2010-02-22 22:17    [W:0.041 / U:0.164 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site