Currently filename_parentat() is inherently buggy, and results in a use after free bug. But removing it and renaming __filename_parentat() destroys its symmetry with the other functions: __filename_create filename_create() __filename_lookup filename_lookup() The ones with leading double-underscores do not free their struct filename arguments, while the ones without double-underscores always do. I looked at the callers of filename_create and filename_lookup. All are small functions which are trivial to modify to include a putname(). It seems to me that adding a few more lines to these functions is a good traedoff for better clarity on lifetimes (as it's uncommon for functions to drop references to their parameters) and better consistency. This small series fixes the UAF and makes it so all three families of functions have just one variation, which does *not* free its pathname arguments. v3: Split patch 1 into a fix and a rename v2: Fix double getname in user_path_create() Stephen Brennan (4): namei: Fix use after free in kern_path_locked namei: Rename __filename_parentat() namei: Standardize callers of filename_lookup() namei: Standardize callers of filename_create() fs/fs_parser.c | 1 - fs/namei.c | 125 ++++++++++++++++++++++++++----------------------- 2 files changed, 67 insertions(+), 59 deletions(-) -- 2.30.2
