Oops, broken patch. Here's the correct one.
----
Subject: vfs: fix possible use after free in finish_open()
From: Miklos Szeredi <mszeredi@xxxxxxx>
In finish_open() nd->path is used after nameidata_to_filp() already
released it. Fix by acquiring a ref to nd->path and releasing after
the last use.
Similar fix needed in do_last().
Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxx>
CC: stable@xxxxxxxxxx
---
fs/namei.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
Index: linux-2.6/fs/namei.c
===================================================================
--- linux-2.6.orig/fs/namei.c 2010-10-26 11:29:16.000000000 +0200
+++ linux-2.6/fs/namei.c 2010-10-26 11:29:20.000000000 +0200
@@ -1549,11 +1549,16 @@ static struct file *finish_open(struct n
error = mnt_want_write(nd->path.mnt);
if (error)
goto exit;
+
+ /* nameidata_to_filp() puts nd->path */
+ path_get(&nd->path);
}
error = may_open(&nd->path, acc_mode, open_flag);
if (error) {
- if (will_truncate)
+ if (will_truncate) {
mnt_drop_write(nd->path.mnt);
+ path_put(&nd->path);
+ }
goto exit;
}
filp = nameidata_to_filp(nd);
@@ -1578,8 +1583,10 @@ static struct file *finish_open(struct n
* because the filp has had a write taken
* on its behalf.
*/
- if (will_truncate)
+ if (will_truncate) {
mnt_drop_write(nd->path.mnt);
+ path_put(&nd->path);
+ }
return filp;
exit:
@@ -1679,8 +1686,11 @@ static struct file *do_last(struct namei
mnt_drop_write(nd->path.mnt);
goto exit;
}
+ /* nameidata_to_filp() puts nd->path */
+ mntget(nd->path.mnt);
filp = nameidata_to_filp(nd);
mnt_drop_write(nd->path.mnt);
+ mntput(nd->path.mnt);
if (!IS_ERR(filp)) {
error = ima_file_check(filp, acc_mode);
if (error) {
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
