lkml.org 
[lkml]   [2010]   [Sep]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH 5/7 v3] vfs: fix possible use after free in finish_open()
    From: Miklos Szeredi <mszeredi@suse.cz>

    If open(O_TRUNC) is called and the actual open fails, then nd->path
    will be released by nameidata_to_filp(). If this races with an
    unmount then mnt_drop_write() can Oops.

    Fix by acquiring a ref to nd->path and releasing after
    mnt_drop_write().

    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    CC: stable@kernel.org
    ---
    fs/namei.c | 9 ++++++++-
    1 file changed, 8 insertions(+), 1 deletion(-)
    Index: linux-2.6/fs/namei.c
    ===================================================================
    --- linux-2.6.orig/fs/namei.c 2010-09-20 13:32:35.000000000 +0200
    +++ linux-2.6/fs/namei.c 2010-09-20 13:33:14.000000000 +0200
    @@ -1559,6 +1559,11 @@ static struct file *finish_open(struct n
    mnt_drop_write(nd->path.mnt);
    goto exit;
    }
    + if (will_truncate) {
    + /* nameidata_to_filp() puts nd->path! */
    + path_get(&nd->path);
    + }
    +
    filp = nameidata_to_filp(nd);
    if (!IS_ERR(filp)) {
    error = ima_file_check(filp, acc_mode);
    @@ -1581,8 +1586,10 @@ static struct file *finish_open(struct n
    * because the filp has had a write taken
    * on its behalf.
    */
    - if (will_truncate)
    + if (will_truncate) {
    mnt_drop_write(nd->path.mnt);
    + path_put(&nd->path);
    + }
    return filp;

    exit:
    --


    \
     
     \ /
      Last update: 2010-09-20 20:07    [from the cache]
    ©2003-2011 Jasper Spaans