lkml.org 
[lkml]   [2020]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 085/104] do_last(): fetch directory ->i_mode and ->i_uid before its too late
    Date
    From: Al Viro <viro@zeniv.linux.org.uk>

    commit d0cb50185ae942b03c4327be322055d622dc79f6 upstream.

    may_create_in_sticky() call is done when we already have dropped the
    reference to dir.

    Fixes: 30aba6656f61e (namei: allow restricted O_CREAT of FIFOs and regular files)
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/namei.c | 17 ++++++++++-------
    1 file changed, 10 insertions(+), 7 deletions(-)

    --- a/fs/namei.c
    +++ b/fs/namei.c
    @@ -1001,7 +1001,8 @@ static int may_linkat(struct path *link)
    * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
    * should be allowed, or not, on files that already
    * exist.
    - * @dir: the sticky parent directory
    + * @dir_mode: mode bits of directory
    + * @dir_uid: owner of directory
    * @inode: the inode of the file to open
    *
    * Block an O_CREAT open of a FIFO (or a regular file) when:
    @@ -1017,18 +1018,18 @@ static int may_linkat(struct path *link)
    *
    * Returns 0 if the open is allowed, -ve on error.
    */
    -static int may_create_in_sticky(struct dentry * const dir,
    +static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,
    struct inode * const inode)
    {
    if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
    - likely(!(dir->d_inode->i_mode & S_ISVTX)) ||
    - uid_eq(inode->i_uid, dir->d_inode->i_uid) ||
    + likely(!(dir_mode & S_ISVTX)) ||
    + uid_eq(inode->i_uid, dir_uid) ||
    uid_eq(current_fsuid(), inode->i_uid))
    return 0;

    - if (likely(dir->d_inode->i_mode & 0002) ||
    - (dir->d_inode->i_mode & 0020 &&
    + if (likely(dir_mode & 0002) ||
    + (dir_mode & 0020 &&
    ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
    (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
    return -EACCES;
    @@ -3248,6 +3249,8 @@ static int do_last(struct nameidata *nd,
    struct file *file, const struct open_flags *op)
    {
    struct dentry *dir = nd->path.dentry;
    + kuid_t dir_uid = dir->d_inode->i_uid;
    + umode_t dir_mode = dir->d_inode->i_mode;
    int open_flag = op->open_flag;
    bool will_truncate = (open_flag & O_TRUNC) != 0;
    bool got_write = false;
    @@ -3383,7 +3386,7 @@ finish_open:
    error = -EISDIR;
    if (d_is_dir(nd->path.dentry))
    goto out;
    - error = may_create_in_sticky(dir,
    + error = may_create_in_sticky(dir_mode, dir_uid,
    d_backing_inode(nd->path.dentry));
    if (unlikely(error))
    goto out;

    \
     
     \ /
      Last update: 2020-01-28 15:06    [W:6.264 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site