Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1251207
| From | lizf@kernel.org |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.4 65/65] vfs: Test for and handle paths that are unreachable from their mnt_root |
| Date | 2015-10-20 03:00 +0200 |
| Message-ID | <qltrs-4x1-35@gated-at.bofh.it> (permalink) |
| References | <qlthL-4kA-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: "Eric W. Biederman" <ebiederm@xmission.com>
3.4.110-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 397d425dc26da728396e66d392d5dcb8dac30c37 upstream.
In rare cases a directory can be renamed out from under a bind mount.
In those cases without special handling it becomes possible to walk up
the directory tree to the root dentry of the filesystem and down
from the root dentry to every other file or directory on the filesystem.
Like division by zero .. from an unconnected path can not be given
a useful semantic as there is no predicting at which path component
the code will realize it is unconnected. We certainly can not match
the current behavior as the current behavior is a security hole.
Therefore when encounting .. when following an unconnected path
return -ENOENT.
- Add a function path_connected to verify path->dentry is reachable
from path->mnt.mnt_root. AKA to validate that rename did not do
something nasty to the bind mount.
To avoid races path_connected must be called after following a path
component to it's next path component.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
fs/namei.c | 29 +++++++++++++++++++++++++++--
1 file changed, 27 insertions(+), 2 deletions(-)
diff --git a/fs/namei.c b/fs/namei.c
index 9c4b9b8..4fc034f 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -397,6 +397,24 @@ void path_put(struct path *path)
}
EXPORT_SYMBOL(path_put);
+/**
+ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
+ * @path: nameidate to verify
+ *
+ * Rename can sometimes move a file or directory outside of a bind
+ * mount, path_connected allows those cases to be detected.
+ */
+static bool path_connected(const struct path *path)
+{
+ struct vfsmount *mnt = path->mnt;
+
+ /* Only bind mounts can have disconnected paths */
+ if (mnt->mnt_root == mnt->mnt_sb->s_root)
+ return true;
+
+ return is_subdir(path->dentry, mnt->mnt_root);
+}
+
/*
* Path walking has 2 modes, rcu-walk and ref-walk (see
* Documentation/filesystems/path-lookup.txt). In situations when we can't
@@ -945,6 +963,8 @@ static int follow_dotdot_rcu(struct nameidata *nd)
goto failed;
nd->path.dentry = parent;
nd->seq = seq;
+ if (unlikely(!path_connected(&nd->path)))
+ goto failed;
break;
}
if (!follow_up_rcu(&nd->path))
@@ -1029,7 +1049,7 @@ static void follow_mount(struct path *path)
}
}
-static void follow_dotdot(struct nameidata *nd)
+static int follow_dotdot(struct nameidata *nd)
{
if (!nd->root.mnt)
set_root(nd);
@@ -1045,6 +1065,10 @@ static void follow_dotdot(struct nameidata *nd)
/* rare case of legitimate dget_parent()... */
nd->path.dentry = dget_parent(nd->path.dentry);
dput(old);
+ if (unlikely(!path_connected(&nd->path))) {
+ path_put(&nd->path);
+ return -ENOENT;
+ }
break;
}
if (!follow_up(&nd->path))
@@ -1052,6 +1076,7 @@ static void follow_dotdot(struct nameidata *nd)
}
follow_mount(&nd->path);
nd->inode = nd->path.dentry->d_inode;
+ return 0;
}
/*
@@ -1252,7 +1277,7 @@ static inline int handle_dots(struct nameidata *nd, int type)
if (follow_dotdot_rcu(nd))
return -ECHILD;
} else
- follow_dotdot(nd);
+ return follow_dotdot(nd);
}
return 0;
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.4 00/65] 3.4.110-rc1 review lizf@kernel.org - 2015-10-20 02:50 +0200
[PATCH 3.4 16/65] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset lizf@kernel.org - 2015-10-20 02:50 +0200
[PATCH 3.4 50/65] crush: fix a bug in tree bucket decode lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 54/65] KVM: x86: properly restore LVT0 lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 56/65] Revert "drm/i915: Don't skip request retirement if the active list is empty" lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 43/65] stmmac: troubleshoot unexpected bits in des0 & des1 lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 35/65] nfs: increase size of EXCHANGE_ID name string buffer lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 55/65] 9p: forgetting to cancel request on interrupted zero-copy RPC lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 46/65] tracing/filter: Do not WARN on operand count going below zero lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 61/65] usb: dwc3: Reset the transfer resource index on SET_INTERFACE lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 24/65] x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 44/65] mm: kmemleak: allow safe memory scanning during kmemleak disabling lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 23/65] regulator: core: fix constraints output buffer lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 60/65] ARM: Fix incorrect backport of 0b59d8806a31 lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 40/65] ext4: don't retry file block mapping on bigalloc fs with non-extent file lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 30/65] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 63/65] IB/qib: Change lkey table allocation to support more MRs lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 65/65] vfs: Test for and handle paths that are unreachable from their mnt_root lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 62/65] jbd2: avoid infinite loop when destroying aborted journal lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 37/65] ext4: call sync_blockdev() before invalidate_bdev() in put_super() lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 48/65] __bitmap_parselist: fix bug in empty string handling lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 59/65] crypto: s390/ghash: Fix incorrect backport of a1cae34e23b1 lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 47/65] tracing/filter: Do not allow infix to exceed end of string lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 58/65] drm/radeon: partially revert "fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling" lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 52/65] ACPICA: Tables: Fix an issue that FACS initialization is performed twice lizf@kernel.org - 2015-10-20 03:00 +0200
RE: [PATCH 3.4 52/65] ACPICA: Tables: Fix an issue that FACS initialization is performed twice "Moore, Robert" <robert.moore@intel.com> - 2015-10-20 15:40 +0200
RE: [PATCH 3.4 52/65] ACPICA: Tables: Fix an issue that FACS initialization is performed twice "Zheng, Lv" <lv.zheng@intel.com> - 2015-10-21 03:30 +0200
[PATCH 3.4 53/65] KVM: x86: make vapics_in_nmi_mode atomic lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 34/65] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 42/65] bridge: multicast: restore router configuration on port link down/up lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 64/65] dcache: Handle escaped paths in prepend_path lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 36/65] bridge: fix br_stp_set_bridge_priority race conditions lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 51/65] fuse: initialize fc->release before calling it lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 38/65] packet: read num_members once in packet_rcv_fanout() lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 57/65] Revert "drm/radeon: Use drm_calloc_ab for CS relocs" lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 49/65] agp/intel: Fix typo in needs_ilk_vtd_wa() lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 27/65] ext4: fix race between truncate and __ext4_journalled_writepage() lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 39/65] packet: avoid out of bounds read in round robin fanout lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 45/65] dell-laptop: Fix allocating & freeing SMI buffer page lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 41/65] watchdog: omap: assert the counter being stopped before reprogramming lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 25/65] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 33/65] ideapad: fix software rfkill setting lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 19/65] SUNRPC: Fix a memory leak in the backchannel code lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 10/65] rndis_wlan: harmless issue calling set_bit() lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 32/65] jbd2: fix ocfs2 corrupt when updating journal superblock fails lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 12/65] usb: dwc3: gadget: return error if command sent to DEPCMD register fails lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 20/65] ipr: Increase default adapter init stage change timeout lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 26/65] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 06/65] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 01/65] hrtimer: Allow concurrent hrtimer_start() for self restarting timers lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 09/65] tty/serial: at91: RS485 mode: 0 is valid for delay_rts_after_send lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 28/65] Disable write buffering on Toshiba ToPIC95 lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 13/65] rcu: Correctly handle non-empty Tiny RCU callback list with none ready lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 22/65] ath9k: fix DMA stop sequence for AR9003+ lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 31/65] regmap: Fix regmap_bulk_read in BE mode lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 15/65] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 02/65] mtd: fix: avoid race condition when accessing mtd->usecount lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 29/65] sctp: fix ASCONF list handling lizf@kernel.org - 2015-10-20 03:10 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-10-20 04:20 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Geert Uytterhoeven <geert@linux-m68k.org> - 2015-10-20 09:10 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Geert Uytterhoeven <geert@linux-m68k.org> - 2015-10-20 11:10 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-10-20 15:00 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-10-20 15:20 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Zefan Li <lizefan@huawei.com> - 2015-10-21 10:10 +0200
csiph-web